Executive brief
The Linux kernel's Mediatek MT7996 WiFi driver contains a use-after-free vulnerability in its hardware reset routine. When the driver resets the WiFi device, it incorrectly frees virtual interface links while still maintaining pointers to internal structures, potentially causing memory corruption or kernel crashes during reset operations.
Technical details
The vulnerability exists in mt7996_mac_full_reset() function in drivers/net/wireless/mediatek/mt76/mt7996/mac.c. The function calls mt7996_mac_reset_vif_iter() which queues non-default virtual interface links for RCU-deferred freeing via kfree_rcu(), while the dev->wcid[] array still holds pointers to wireless connection IDs embedded in those links. The subsequent call to mt76_reset_device() then dereferences these pointers and runs mt76_wcid_cleanup(), which operates on memory that may have been freed if an RCU grace period elapses. The fix reorders the calls to invoke mt76_reset_device() before the interface iterator, ensuring wcid entries are cleaned up and cleared while the links are still valid. No CVSS score or exploit-in-the-wild evidence is publicly available.
Affected products
- Linux Linux kernel 5.0 and later
Timeline
- 2026-09-17: disclosed
- 2026-07-24: patched