Executive brief
The Linux kernel's MT7925 WiFi driver contains a timing flaw in its power management logic where a delayed work task can continue executing after the device is reset, suspended, or disconnected. If this occurs, the task may access data structures that have already been freed or attempt to send commands to unavailable firmware, causing system crashes or unstable operation. This affects devices using the Mediatek MT7925 WiFi chipset on PCIe and USB interfaces.
Technical details
The vulnerability is a use-after-free condition in the MT7925 WiFi driver's multi-link operation power management work handler (mlo_pm_work). The delayed work queue is not properly cancelled during device teardown and suspend paths, allowing the pending task to execute and access freed virtual interface (vif) and basic service set (bss) data structures, or send MCU commands when firmware is unavailable. The fix adds cancel_delayed_work_sync() calls in five critical paths: chip reset recovery (mt7925_mac_reset_work), PCIe device unbind (mt7925e_unregister_device), PCIe bus suspend (mt7925_pci_suspend), mac80211 suspend (mt7925_suspend), and USB/runtime suspend (mt7925u_suspend). This ensures synchronous cancellation before device state becomes invalid. Patch commits: 2889e84282dda147f10b10d94cf0efd90a349c53 (mainline) and 5be6d02837d418bc6c805b5cab1b338de6de9ca7 (stable).
Affected products
- Linux Linux kernel 5.x through 7.x (fixed in stable releases)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-07-31: patched: Mainline kernel commit 2889e84282dda147f10b10d94cf0efd90a349c53
- 2026-09-07: patched: Stable kernel commit 5be6d02837d418bc6c805b5cab1b338de6de9ca7