Authored by Google Security Research, Seth Jenkins

The MediaTek WLAN driver has VFS read handlers that do not check buffer size leading to userland memory corruption.