EUVD-2026-76259
GHSA-59xf-cqg5-4cpj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition (AC:H) requires precise local teardown timing; impact is kernel crash only (A:H), not code execution, so C:N/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: cancel mlo_pm_work on stop
mt7925 queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives the teardown and its timer fires afterwards, trying to queue onto the workqueue that is already gone:
workqueue: cannot queue mt7925_mlo_pm_work [mt7925_common] on wq phy0 WARNING: kernel/workqueue.c:2283 at __queue_work+0x59/0xa0, CPU#1: swapper/1/0 call_timer_fn+0x2a/0x140 __run_timers+0x203/0x330 run_timer_softirq+0x86/0xf0
mt7921 already has its own stop callback, so add one for mt7925 that cancels the work before calling mt792x_stop(). mt7925_ops backs both the PCIe and USB drivers, so this covers both.
AnalysisAI
The mt7925 WiFi driver (mt76 subsystem) in the Linux kernel fails to cancel a deferred work item on the device stop path, creating a 5-second race window during multi-link operation (MLO) power-save setup. If the mt7925 PCIe or USB device is torn down within that window, the surviving timer fires against a workqueue that has already been destroyed, triggering a kernel WARNING and potential crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a MediaTek mt7925 WiFi adapter (PCIe or USB) is present and bound to the mt7925 Linux driver; (2) the kernel version is in the affected range (6.14.3-6.18.x prior to 6.18.50, or 6.15-7.2.x prior to 7.2.4); (3) MLO (multi-link operation) power-save setup has been initiated so that mlo_pm_work is scheduled with a 5-second delay; (4) device teardown (driver unbind, module removal, or physical hot-unplug) occurs within that 5-second window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H) is substantially overstated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 6.18.50, 7.2.4, or 7.3-rc1, which contain the fix that adds a mt7925_stop() callback calling cancel_delayed_work_sync() before device teardown. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems with mt7925 WiFi devices running vulnerable Linux kernel versions and confirm whether multi-link operation power-save is enabled in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today