Executive brief
A memory leak was identified in the Linux kernel's MediaTek Wi-Fi driver (mt76). When the Wi-Fi device or driver module is shut down or unloaded, certain memory resources used for network data queues are not properly released. Over time, or through repeated driver restarts, this could lead to system memory exhaustion, potentially impacting system stability or performance.
Technical details
A memory leak exists in the mt76 wireless driver within the Linux kernel's DMA cleanup path. All MT76 receive (RX) queues are associated with a page_pool, including those not linked to a NAPI instance (such as Wireless Ethernet Dispatcher (WED) RRO queues). The vulnerability stems from the mt76_dma_cleanup routine failing to destroy these pools during module unload or device destruction. Additionally, pages were not being correctly returned to the pool when WED was disabled for specific RRO queues. The fix ensures mt76_dma_rx_cleanup is called for all queues and properly handles page returns. This is primarily a local denial-of-service risk through memory exhaustion.
Affected products
- Linux Linux 6.8 to 6.18.32, 7.0.0 to 7.0.9
Timeline
- 2025-12-08: other: Patch authored
- 2026-06-24: advisory: CVE published and NVD record created