Executive brief
The Linux kernel's mt76 WiFi driver contains a NULL pointer dereference bug when running on Mediatek/Airoha NPU systems with certain configuration options enabled. A system crash (kernel panic) can occur during driver initialization, causing loss of network connectivity and service unavailability.
Technical details
A NULL pointer dereference vulnerability exists in the mt7996_init_tx_queues() function within the mt76 wireless driver. When MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are both enabled and the driver detects an Airoha NPU SoC, the function receives a NULL WED (Wireless Engine Dispatch) pointer instead of the valid pointer passed from mt7996_dma_init(). This causes an immediate kernel panic when the function attempts to dereference the NULL pointer. The root cause is a logic error where NULL was hardcoded as an argument instead of passing the WED pointer through. The fix involves changing a single line in drivers/net/wireless/mediatek/mt76/mt7996/dma.c to pass the correct WED pointer. This is a kernel-level bug that affects systems with specific hardware and configuration combinations.
Affected products
- Linux Linux kernel various (patch available for stable branches)
Timeline
- 2026-08-28: disclosed
- 2026-04-18: patched: Fix committed to mainline by Lorenzo Bianconi
- 2026-06-09: patched: Backported to stable branches by Felix Fietkau
- 2026-07-24: patched: Integrated into stable kernel releases