Linux Kernel EUVD-2026-45498

Exploitation requires the target to be running an affected Linux kernel with the mt76/mt7925 driver active and MediaTek MT7925 wireless hardware in use - the bug is reached specifically through the station-add path during WiFi (re)association/roaming, as shown by the disconnect/authenticate sequence in the report and the mt76_wcid_add_poll → mt7925_mac_add_txs call chain. Limiting factors: the system must actually use the MT7925 chipset and the vulnerable driver, exposure is adjacent-network (AV:A, WiFi radio range) rather than routable Internet, and triggering depends on association/roaming timing that resembles a race window, so it is not deterministically attacker-controlled against a default idle configuration. Systems without MT7925 hardware or with the mt7925 driver unloaded are not affected.

The supplied CVSS 3.1 score is 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, implying adjacent-network, low-complexity, unauthenticated full-impact compromise. Several signals argue this overstates real-world risk: EPSS is only 0.15% (5th percentile), there is no KEV listing and no public exploit, and the described root cause is a linked-list corruption triggered by internal driver state during association rather than a cleanly attacker-controlled primitive. The C:H/I:H rating conflicts with the actual evidence, which shows a kernel panic (availability/DoS) as the realistic outcome; turning list corruption into reliable code execution on modern kernels with hardened list checks is difficult and unproven here. The tag 'Information Disclosure' also conflicts with the described list-corruption crash and should be treated with skepticism. AC:L is questionable because the corruption appears tied to specific association/roaming timing (a race-like window), so AC:H is more defensible. Net: this is a legitimate memory-corruption bug worth patching, but current evidence supports a local/adjacent denial-of-service priority rather than a confirmed remote code execution emergency.

A user with an MT7925 adapter roams between or reconnects to WiFi access points (as in the reported log where the client re-authenticates to a nearby AP); during the resulting station-add path the driver corrupts its sta_poll_list, and subsequent RX/TX-status processing dereferences the broken list and panics the kernel. An attacker within WiFi range could plausibly provoke repeated re-association (for example by spoofing or disrupting APs to force roaming) to trigger the crash as a denial of service. No public proof-of-concept is known, and reliable code execution from this corruption is unproven.