Executive brief
The mt7996 wireless driver in the Linux kernel contains a logic error in how it assigns link IDs when handling multi-link device (MLD) stations, particularly when a third wireless link is in power-saving mode. This can cause the wireless firmware to enter a busy loop, triggering MCU command timeouts and service interruptions on affected systems using Mediatek WiFi hardware.
Technical details
The vulnerability is a firmware state synchronization bug in the mt76 driver's handling of multi-link wireless stations. The root cause: if the MLD_ID field in the TX descriptor (TXD) references a link ID that is neither the primary nor secondary link, the firmware can enter a busy loop when that third link is in power-saving mode, resulting in "ERROR!! NO PAUSE..." firmware logs and MCU command timeouts. The fix remaps frames directed to a third link to use the primary link's wireless connection ID (wcid) for TX descriptor and HIF transmit path (TXP) fields, ensuring the firmware only sees primary or secondary link references. Precondition: requires multi-link device mode with three or more links where at least one is in power save. This is addressed in upstream Linux kernel via commit ce35ecffc96e6d097d27b6fe30677a2cfe2e0461.
Affected products
- Linux Linux kernel 5.x, 6.x kernels with mt7996 WiFi driver (affecting Mediatek mt7996 chipsets)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-07-22: patched: Fix committed upstream by Peter Chiu