Executive brief
The Linux kernel's mt76 WiFi driver contains a race condition in how it recycles memory buffers used for receiving wireless data (RXDMAD_C buffers). This buffer mismanagement could cause memory corruption or system instability on devices using Mediatek WiFi chipsets, potentially leading to denial of service or data loss.
Technical details
The vulnerability is a race condition in the mt76 DMA buffer management code (drivers/net/wireless/mediatek/mt76/dma.c). RXDMAD_C buffers are allocated from page pools bound to a different NAPI (network API) context than the receiving queue, but the code was using direct page-pool recycling that could race with the owning NAPI thread. The fix disables direct page-pool recycling for these buffers by adding a check (!mt76_queue_is_wed_rro_rxdmad_c) to the allow_direct flag, forcing the use of a safer non-direct recycling path. This is a memory-safety issue affecting the kernel's wireless driver subsystem that requires no user interaction or authentication to trigger.
Affected products
- Linux Linux kernel affected versions include linux-5.10.y through linux-6.x.y series
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Fix committed by Greg Kroah-Hartman on 2026-09-14