Executive brief
The Linux kernel's mt76 WiFi driver for MediaTek MT7915 chips has a bug where device initialization code runs twice on systems without WED (Wireless Ethernet Dispatch) hardware. This causes a leaked device reference and corrupted state that could result in driver malfunction or system instability on affected systems.
Technical details
A double-initialization bug exists in mt7915_pci_probe() where mt7915_pci_init_hif2() is called unconditionally, then again within the WED-inactive branch. The function increments a global hif_idx counter, writes PCIe RECOG_ID register state, and acquires a device reference via get_device(), but the cleanup path only releases one reference. On non-WED dual-hif systems, this results in: hif_idx being double-incremented, RECOG_ID register written twice, and a leaked device reference. The vulnerability is a logic error in the probe function; the unconditional call should be removed as hif2 is already initialized to NULL. No user interaction or network attack vector is required—this manifests only during driver probe on affected hardware. A patch removing the redundant unconditional call is available.
Affected products
- Linux Linux kernel versions containing commit cacdd67812c6 up to the fix (precise range not specified in advisory)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Upstream fix included in stable releases via commit 249cbaa and 29fbc52