Executive brief
The Linux kernel's mt76 WiFi driver for MediaTek MT7925 chips contains a use-after-free vulnerability in the wireless packet receive processing function. A race condition allows the driver to access freed memory when a wireless station is removed while packets are still being processed, potentially causing a kernel crash or memory corruption. This affects systems using MediaTek MT7925 WiFi adapters.
Technical details
A use-after-free vulnerability exists in the mt76_rx_poll_complete() function due to an insufficient cleanup when multi-link devices (MLDs) are disconnected. When a station (STA) is removed via ieee80211_ops.sta_pre_rcu_remove(), the rx_status structure still holds a dangling pointer (wcid) to the freed STA's wireless connection ID. The race condition occurs because rx polling can occur concurrently with STA removal. The fix implements mt7925_sta_pre_rcu_remove() to explicitly null out wcid pointers for all links in an MLD before STA removal completes, ensuring the rx poll path cannot dereference freed memory. The vulnerability is triggered when processing incoming WiFi frames on affected systems and requires no special user interaction—normal network activity can trigger it.
Affected products
- Linux Linux Kernel affected versions prior to the fix commit 217f9e7bb02558759be9d9ecfe532e9708741c50
Timeline
- 2026-09-17: disclosed
- 2026-07-01: patched: Fix committed upstream