Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt76) that could lead to system instability or crashes. The issue occurs when the system incorrectly reinitializes internal tracking lists during wireless station management, potentially corrupting memory. This could result in a denial-of-service (system crash) for devices using affected MediaTek wireless hardware.
Technical details
A list corruption vulnerability exists in the mt76 driver within the Linux kernel due to improper handling of Wireless Client ID (WCID) initialization. In the mt76_sta_add function, the driver failed to check if a WCID was already published before reinitializing the wcid->poll_list. This lack of validation leads to dev->sta_poll_list corruption, specifically where a list element's next pointer points to itself (list_add corruption). The issue was primarily observed on mt7925 hardware. A fix has been implemented to add a publish check in mt76_sta_add to prevent redundant initialization. Patches are available in kernel versions 6.18.38, 7.1.3, and 7.2-rc1.
Affected products
- Linux Linux Kernel 6.18.38, 7.1.3, 7.2-rc1
Timeline
- 2026-07-19: advisory: NVD publication date
- 2026-07-04: patched: Fixes committed to stable branches