mt76 ExtPhy UAF

Vulnerability analysis

During WiFi driver initialization for the MediaTek MT7915 chipset, if a resource allocation fails after the secondary (ext) PHY has been successfully registered, the error-handling path frees the ext PHY's hardware structure without first unregistering it from the mac80211 subsystem. This leaves mac80211 with dangling references to freed memory, and any subsequent operation on that PHY triggers a use-after-free. The fix changes the error path to properly unregister the ext PHY — including its thermal, PHY, and hardware components — before continuing cleanup, and clears the pointer so the later generic teardown does not attempt a redundant free. The vulnerable code path is reachable only on systems with MT7915 WiFi hardware present, and the error is triggered when a memory allocation fails during driver initialization, which a local unprivileged user could attempt to induce through memory pressure, though timing it to hit the exact init step is difficult.