Linux Kernel mt76 EUVD-2026-38972

Exploitation requires local access with sufficient privilege to trigger mt76 module unload - in practice this means root or CAP_SYS_MODULE capability, making the NVD-assigned PR:L potentially optimistic. The target system must have a MediaTek MT76-series WiFi chipset physically present with the mt76 driver loaded. The WED RRO-specific leak path additionally requires WED (Wireless Ethernet Dispatch) to be enabled, which is a hardware and configuration dependency specific to MediaTek SoC-based platforms (e.g., MT7986-based routers). The secondary leak (pages not returned when WED is not enabled) affects a broader set of mt76 deployments but still requires local access and module teardown. Normal system operation without module unloading does not continuously leak memory. There is no remote attack vector, no unauthenticated path, and no confidentiality or integrity impact. Systems without MT76 hardware or running patched kernels (7.1, 7.0.10, 6.18.33) are not exposed.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a local, low-complexity, low-privilege denial-of-service with no confidentiality or integrity impact. The EPSS score of 0.17% at the 6th percentile is in line with a narrow-scope kernel driver bug that has no direct exploitation primitive beyond memory exhaustion. There is no CISA KEV listing and no known public POC, confirming no active exploitation at time of analysis. The 'Information Disclosure' tag present in the intelligence feed is inconsistent with CWE-401 and the CVSS C:N/I:N metrics - this appears to be a mislabeling artifact and should not inform risk decisions. Note also that unloading kernel modules generally requires elevated privilege (CAP_SYS_MODULE), which may make the NVD-assigned PR:L conservative; actual privilege requirement may be closer to PR:H depending on system configuration. Real-world priority is low: this is a normal-cycle kernel patch applicable to hardware-specific embedded or router deployments, not an emergency remediation item.

A local user with module-unloading privileges (typically root) on a router or embedded device running an affected kernel with MT76 WiFi hardware scripts repeated modprobe -r mt76 and modprobe mt76 cycles, causing page_pool memory to leak on each unload without being reclaimed. Over sufficient iterations, kernel memory is progressively exhausted, eventually triggering an out-of-memory condition that crashes or hangs the device, constituting a local denial of service. No public exploit code exists for this vulnerability.