Executive brief
The Linux kernel's MediaTek mt7915 WiFi driver contains a use-after-free vulnerability in its hardware initialization error handling. When certain initialization steps fail after registering an extended PHY (secondary wireless interface), the driver incorrectly frees hardware structures that are still registered with the kernel's networking stack, leading to memory corruption and potential kernel crashes. This affects systems using MediaTek mt7915 wireless adapters.
Technical details
This is a use-after-free vulnerability in the mt76 driver's mt7915_register_device() error handling path. When mt7915_init_debugfs() or mt7915_coredump_register() fail after mt7915_register_ext_phy() succeeds, the unwinding code path (free_phy2) calls ieee80211_free_hw() on the extended PHY's hardware structure while it is still registered with mac80211. The root cause is that mt76_unregister_device() only unregisters the main hardware interface, leaving the extended PHY registered. The fix adds a new error handler (unreg_ext_phy) that properly unregisters the thermal, PHY, and hardware components of the extended interface before freeing. Local or adjacent network access to a system with a vulnerable mt7915 device may trigger this during driver initialization failures.
Affected products
- Linux Linux kernel affected versions include linux-6.x and related stable branches; patched in commit 15b960014f24dce5388d4a2e7274e6490cb3c421
Timeline
- 2026-09-17: disclosed
- 2026-08-01: patched: Upstream fix commit 15b960014f24dce5388d4a2e7274e6490cb3c421