Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt76) that could lead to system instability or crashes. The issue stems from how the driver manages internal lists of pending data transmissions, which can become corrupted under certain conditions. If exploited, this could allow an attacker within Wi-Fi range to disrupt network services or potentially gain unauthorized access to system memory.
Technical details
A linked list corruption vulnerability exists in the mt76 driver within the Linux kernel's wireless subsystem. The root cause is located in the `mt76_txq_schedule_pending` function in `drivers/net/wireless/mediatek/mt76/tx.c`, where scheduled Wireless Client ID (wcid) entries could be left on a temporary on-stack list if an error occurred during scheduling. This occurs because the loop could break early without properly cleaning up the temporary list, leading to use-after-free or invalid memory access when the stack frame is popped. An attacker within radio range could potentially trigger this condition to cause a Denial of Service (DoS) or achieve arbitrary code execution. The issue has been resolved by ensuring the loop continues to drain the temporary list even after a scheduling failure.
Affected products
- Linux Linux Kernel 6.12 to 6.12.46, 6.13 to 6.16.6, 6.17-rc1 to 6.17-rc4
Timeline
- 2025-08-27: patched: Initial fix committed to kernel source
- 2025-10-01: disclosed: CVE published by kernel.org