Executive brief
The Linux kernel's Mediatek mt7925 WiFi driver contains a null pointer dereference vulnerability in the mt7925_mcu_bss_he_tlv() function. If mt76_connac_get_he_phy_cap() returns NULL, the code attempts to dereference this NULL pointer, potentially causing a kernel crash or system instability.
Technical details
This is a null pointer dereference vulnerability in the mt7925 WiFi driver module (drivers/net/wireless/mediatek/mt76/mt7925/mcu.c). The vulnerable function mt7925_mcu_bss_he_tlv() calls mt76_connac_get_he_phy_cap() which can theoretically return NULL, but the code did not check for this condition before dereferencing the returned pointer. The fix adds a simple NULL check and early return if the pointer is NULL. This vulnerability is local to the system and requires the mt7925 driver to be loaded; exploitation would result in a kernel panic or denial of service.
Affected products
- Linux Linux kernel multiple versions (affected in mt7925 driver introduced in c948b5da6bbec)
Timeline
- 2026-08-12: disclosed
- 2026-06-21: patched: Upstream patch committed; backported to stable trees