Executive brief
A vulnerability in the Linux kernel's MediaTek Wi-Fi driver could cause a system crash (kernel panic) when handling specific wireless network signals. The issue occurs when a device receives a channel-switch instruction at the same time a connection is being torn down, leading to a system failure. This primarily impacts the stability and availability of devices using MediaTek mt7921 or mt7925 wireless chipsets.
Technical details
A race condition exists in the mt76 driver's handling of Channel-Switch Announcement (CSA) beacons. When a CSA beacon is received, cfg80211 queues a work item that calls mt7921_channel_switch_rx_beacon() or mt7925_channel_switch_rx_beacon(). If the station disconnects or the channel context is torn down before the work item executes, the 'dev->new_ctx' pointer is cleared to NULL. The driver subsequently dereferences this NULL pointer without validation, resulting in a kernel oops. The fix introduces an early-return NULL check for 'dev->new_ctx' in the affected functions. This affects Linux kernel versions including 6.14 and 7.1.4.
Affected products
- Linux Linux Kernel 6.14, 7.1.4, 7.2-rc1
Timeline
- 2026-05-02: disclosed: Bug reported by Bongani Hlope
- 2026-05-04: patched: Initial patch authored
- 2026-07-25: advisory: NVD publication date