EUVD-2026-59472
GHSA-4hx5-9m7x-6xgv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between softirq and teardown warrants AC:H; local-only trigger and low-privilege WiFi access correctly set AV:L and PR:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree() after rcu_assign_pointer(NULL). However, rcu_assign_pointer only prevents future RCU readers from obtaining the pointer -- it does not wait for existing readers that already hold it via rcu_dereference.
The TX datapath (e.g. mt7996_mac_write_txwi) dereferences mlink->wcid and mlink->idx under rcu_read_lock. If a TX softirq obtained the pointer via rcu_dereference just before the NULL assignment, it will dereference freed memory after the kfree.
struct mt76_vif_link already contains an rcu_head field that is unused at this free site -- a developer oversight, since the adjacent kfree_rcu_mightsleep call for rx_sc in the same function shows the pattern was understood.
Replace kfree(mlink) with kfree_rcu(mlink, rcu_head).
AnalysisAI
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access with privileges sufficient to manipulate WiFi interfaces (PR:L, AV:L) - typically a user in the netdev or wheel group, or one with CAP_NET_ADMIN capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates exploitability: the AC:L rating does not account for the inherent timing requirement of the race condition between the offchannel teardown path and a concurrent TX softirq. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with low-privilege access on a system running a vulnerable kernel with an active MediaTek WiFi adapter initiates repeated offchannel scan or P2P operations to trigger mt76_put_vif_phy_link() while simultaneously flooding the TX queue to keep the TX softirq active. If a TX softirq obtains the mlink pointer via rcu_dereference() in mt7996_mac_write_txwi() just before the NULL assignment races with the kfree(), the softirq dereferences freed memory, enabling kernel heap corruption that can be leveraged for local privilege escalation to root. … |
| Remediation | The primary fix is to upgrade to Linux kernel 6.18.40, 7.1.5, or 7.2-rc1, which replace kfree(mlink) with kfree_rcu(mlink, rcu_head) in mt76_put_vif_phy_link(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, query your systems inventory to identify kernel versions running the mt76 driver, focusing on IoT devices, wireless access points, and edge compute platforms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today