Executive brief
The Linux kernel's MediaTek MT7915 WiFi driver had a race condition in the interface removal code that could cause wireless connection identifiers (wcids) to be leaked or incorrectly reused. This could lead to authentication failures, dropped connections, or incorrect routing of network traffic on affected WiFi devices.
Technical details
The vulnerability is a race condition (CWE-362) in the mt7915_remove_interface() function of the MT76 wireless driver. The wcid (wireless connection ID) mask bit was cleared without holding the required dev->mt76.mutex lock and before clearing the RCU pointer. Since the mask is a non-atomic read-modify-write shared with allocators (all of which hold the mutex), this created a race with concurrent add_interface/sta_add operations on DBDC (dual-band dual-concurrent) hardware. An attacker or concurrent operation could reuse the wcid index and publish it before the subsequent NULL assignment wiped it, causing wcid leaks or double allocation. The fix moves the mt76_wcid_mask_clear() call into the existing mutex-protected section, after the RCU pointer is cleared. Patches are available in upstream Linux kernel.
Affected products
- Linux Linux kernel Multiple versions (affected in MT7915 driver)
Timeline
- 2026-09-17: disclosed
- 2026-07-22: patched