Executive Summary

This vulnerability is a use-after-free (UAF) bug in the Linux kernel's mt7915 wifi driver. It occurs when the mt7915 PCI chip is being detached. During this process, the crash data structure (mt7915_crash_data) is freed, but a work item called dump_work may still be running or queued. If dump_work accesses the already freed crash_data, it leads to a use-after-free condition, which is a type of memory error.

The issue arises due to a race condition between the removal path on one CPU and the workqueue on another CPU. The fix involves properly canceling the dump_work before freeing the crash_data by adding cancel_work_sync() in the unregister function to ensure synchronization.

Useful 0 Not Useful 0

Impact Analysis

A use-after-free vulnerability can lead to undefined behavior such as system crashes, memory corruption, or potentially allow an attacker to execute arbitrary code with kernel privileges. In this specific case, it could destabilize the wifi driver or the entire system when the mt7915 PCI chip is detached, potentially leading to denial of service or security breaches.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the Linux kernel version you are using includes the fix for the mt7915 use-after-free bugs in mt7915_mac_dump_work().

Specifically, the fix involves adding cancel_work_sync() in mt7915_unregister_device() to properly cancel any pending or executing dump work before the crash_data is deallocated.

Therefore, updating your kernel to a version released on or after 2026-06-24 that contains this patch is the immediate step to prevent this race condition and use-after-free issue.

Useful 0 Not Useful 0