Executive brief
The Linux kernel's mt76 WiFi driver for MediaTek MT7996 hardware contains a race condition in the system error recovery (SER) handler. During a simultaneous channel switch and error recovery, the tx worker can be unparked and DMA reset state cleared while the reset path is resetting DMA rings, leading to memory corruption and potential system instability.
Technical details
The vulnerability is a synchronization race condition in the mt7996 MAC reset handler. The function mt7996_mac_reset_work() was disabling the tx worker and RX/TX NAPIs before acquiring dev->mt76.mutex, while __mt76_set_channel() modifies the same worker and MT76_RESET bit under mutex protection. During an L1 SER (Level 1 System Error Recovery) event racing with a channel switch, the worker could be unparked and MT76_RESET cleared by the channel switch code while the reset path is actively resetting DMA rings and descriptors. This causes memory corruption of DMA descriptors and token state. The fix moves mutex acquisition before worker disable, matching the pattern used in mt7915. No user interaction required; local system access needed to trigger channel switch operations concurrently with hardware errors. Patch available in upstream kernel commit 6190db312b8230813f529f014b26247c6d9800d0.
Affected products
- Linux Linux kernel Affected versions include Linux kernel 6.x series; patched in commit 6190db312b8230813f529f014b26247c6d9800d0
Timeline
- 2026-09-17: disclosed
- 2026-07-31: patched: Upstream patch merged
- 2026-09-14: advisory: Stable release with patch