Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt7925) that could cause a system crash. The issue occurs when the system attempts to process wireless network traffic under specific conditions, leading to a 'NULL pointer dereference.' In practice, this could allow a local user or a specific network event to trigger a Blue Screen of Death (or kernel panic), resulting in a loss of system availability.
Technical details
A NULL pointer dereference vulnerability exists in the mt7925_tx_check_aggr() function within the drivers/net/wireless/mediatek/mt76/mt7925/mac.c component of the Linux kernel. The root cause is a logic error where the 'sta' (station) pointer is dereferenced via rcu_dereference(sta->link[...]) before a NULL check is performed. An attacker or specific network conditions could trigger this code path, leading to a kernel panic. The vulnerability has been resolved by moving the NULL check for 'sta' before its first dereference. Patches are available in various stable kernel branches including 6.12.91, 6.18.33, and 7.0.10.
Affected products
- Linux Linux Kernel 6.11 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-06-26: advisory
- 2026-06-26: disclosed