Executive brief
A vulnerability exists in the Linux kernel's MediaTek Wi-Fi driver (mt7996) that could lead to a system crash. When the Wi-Fi hardware is being removed or detached from the system, a race condition can occur where the system tries to access memory that has already been freed. This typically results in a 'use-after-free' error, which can impact system stability and availability.
Technical details
A use-after-free (UAF) vulnerability exists in the mt7996 driver within the mt76 wireless stack. The root cause is a race condition between the PCI device removal path (mt7996_pci_remove) and the workqueue responsible for MAC dumping (mt7996_mac_dump_work). When a chip is detached, mt7996_coredump_unregister() frees the crash_data memory; however, if a dump_work item is still pending or running on another CPU, it may attempt to dereference this freed memory. An attacker or a system event triggering device removal could cause a kernel panic. The fix involves adding cancel_work_sync() in the unregister path to ensure all pending work is completed or cancelled before memory deallocation.
Affected products
- Linux Linux 6.4 to 7.1
Timeline
- 2026-01-31: other: Patch submitted by developer
- 2026-06-24: advisory: CVE published by NVD