HIGH
mt76 MloPmWork UAF
CVE-2026-89523
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo_pm_work If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the firmware is not available. Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown and suspend paths: - mt7925_mac_reset_work() (chip reset recovery) - mt7925e_unregister_device() (PCIe unbind) - mt7925_pci_suspend() (PCIe bus suspend) - mt7925_suspend() (mac80211 suspend) - mt7925u_suspend() (USB bus / runtime suspend) This ensures the work is stopped before the device state becomes invalid.
02KernelScan AI Analysis
Risk summary
Devices using the MediaTek MT7925 WiFi chipset are vulnerable to a use-after-free in the MLO power-management work queue. An attacker within WiFi range can trigger a device reset while the pending work is scheduled, causing the work to access freed memory. This can lead to kernel memory corruption, potentially allowing code execution or a system crash.
Vulnerability analysis
A delayed work item that handles power saving for multi-link WiFi connections is scheduled during normal operation but is not cancelled when the device is reset, suspended, or unregistered. If teardown happens while the work is still pending, the work runs and accesses wireless interface and network data structures that have already been freed, or sends commands to firmware that is no longer available. This results in a use-after-free. The fix cancels the pending work in every teardown and suspend path so it cannot run after device state becomes invalid. An attacker within WiFi range can trigger this by causing a firmware crash or device reset while the power-saving work is pending. The bug can also be triggered by a local user initiating system suspend or device removal, though that requires elevated privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | — | 7.3-rc1 | — |
| 7.2 | — | 7.2.4 | 2889e84282dd |
| 6.14 | 6.14.3 | 6.15 | 5be6d02837d4 |
| 6.18 | — | 6.18.50 | c5e073f2fbfd |