Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt7925) that could lead to a system crash. The issue occurs when the driver attempts to process wireless traffic using an uninitialized data structure. An exploit could result in a kernel panic, causing a complete denial of service for the affected system.
Technical details
A NULL pointer dereference exists in the mt7925_mac_write_txwi function within the drivers/net/wireless/mediatek/mt76/mt7925/mac.c component of the Linux kernel. The vulnerability is triggered when the code attempts to access ieee80211_vif_is_mld(vif) without first verifying that the virtual interface (vif) pointer is initialized. This can occur during specific TX descriptor writing operations. A local attacker or specific network conditions could trigger this dereference, leading to a kernel panic (DoS). Patches have been released for multiple stable kernel branches including 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.11, 6.12.91, 6.18.33, 7.0.10
Timeline
- 2025-09-04: other: Patch authored
- 2026-06-24: disclosed: CVE published