EUVD-2026-76429
GHSA-2cmm-rm3g-hc7x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing required to win the teardown window elevates AC to H; local access and low privileges needed to trigger suspend/reset.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: cancel pending mlo_pm_work
If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the firmware is not available.
Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown and suspend paths:
- mt7925_mac_reset_work() (chip reset recovery)
- mt7925e_unregister_device() (PCIe unbind)
- mt7925_pci_suspend() (PCIe bus suspend)
- mt7925_suspend() (mac80211 suspend)
- mt7925u_suspend() (USB bus / runtime suspend)
This ensures the work is stopped before the device state becomes invalid.
AnalysisAI
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) physical or virtual presence of a MediaTek mt7925 Wi-Fi 7 chipset (PCIe or USB variant) in the target system; (2) a kernel version in the affected range (post commit 276a568832577c81ec90b62dc506bbdc3781ca46, prior to fix commits); (3) ability to trigger device teardown operations such as suspend, PCIe unbind, or chip reset from local user space (PR:L); (4) correct race timing between work scheduling and teardown. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 7.8) overstates attack complexity: exploiting this vulnerability requires winning a specific timing race between a teardown operation and the scheduled work execution, which is inherently an AC:H condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the relevant upstream fix commit for the kernel branch in use: commit 5be6d02837d418bc6c805b5cab1b338de6de9ca7 (https://git.kernel.org/stable/c/5be6d02837d418bc6c805b5cab1b338de6de9ca7), commit c5e073f2fbfd34d22099a50d96f60990799753e2 (https://git.kernel.org/stable/c/c5e073f2fbfd34d22099a50d96f60990799753e2), or commit 2889e84282dda147f10b10d94cf0efd90a349c53 (https://git.kernel.org/stable/c/2889e84282dda147f10b10d94cf0efd90a349c53), depending on the stable series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Linux kernels with the mt76/mt7925 Wi-Fi 7 driver, prioritizing production servers and infrastructure devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today