Executive brief
The Linux kernel's mt76 WiFi driver contains a logic error in channel context handling when switching channels on multiple radios simultaneously. This can cause improper channel configuration or radio state management, potentially resulting in WiFi connectivity issues, dropped connections, or unpredictable wireless behavior on affected devices.
Technical details
The vulnerability exists in the mt76_switch_vif_chanctx() function in the mt76 WiFi driver. The function improperly handled scenarios where multiple channel context switches occur on different radios (bands) within a short timeframe. The root cause is insufficient tracking of which PHY (radio) bands have been processed during context switches, leading to incorrect state updates. The vulnerability is reachable through normal WiFi operations involving channel switching (e.g., during multi-band simultaneous operations). A patch reworks the function to maintain per-band update tracking using an array indexed by band_idx instead of a single boolean flag, ensuring proper handling of multi-band scenarios. The fix has been integrated into the stable kernel tree.
Affected products
- Linux Linux kernel 5.0 and later (affected via mt76 driver in wireless/mediatek subsystem)
Timeline
- 2026-09-17: disclosed
- 2026-07-20: patched: Patch committed upstream; backported to stable