CVE-2026-89523

Received Received - Intake

Race Condition in MediaTek MT76 WiFi Driver

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo_pm_work If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the firmware is not available. Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown and suspend paths: - mt7925_mac_reset_work() (chip reset recovery) - mt7925e_unregister_device() (PCIe unbind) - mt7925_pci_suspend() (PCIe bus suspend) - mt7925_suspend() (mac80211 suspend) - mt7925u_suspend() (USB bus / runtime suspend) This ensures the work is stopped before the device state becomes invalid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89523

EUVD

EUVD-2026-76429

Affected Vendors & Products

Vendor	Product	Version / Range
mt76	mt7925	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects the mt76 driver for MediaTek MT7925 WiFi devices. It involves a delayed work item called mlo_pm_work that may still execute after the device is reset, suspended, or unregistered. This can lead to accessing freed memory or sending commands to unavailable firmware.

Detection Guidance

This vulnerability affects the Linux kernel's mt76 driver for MediaTek MT7925 WiFi devices. Detection requires checking kernel logs for related errors during device reset, suspend, or unregister operations. Monitor logs for messages about mlo_pm_work or mt7925 device issues.

Impact Analysis

If exploited, this could cause system instability, crashes, or potential privilege escalation due to memory corruption or firmware command failures. Users may experience WiFi disconnections or system freezes during device teardown or suspend operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue related to WiFi device management that could lead to memory corruption or firmware command issues during device teardown. Compliance impacts would only occur if this vulnerability were exploited to compromise data integrity or availability in a system handling regulated data.

Mitigation Strategies

Apply kernel updates that include the fix for CVE-2026-89523. Ensure your Linux kernel version includes the patch for mt76 driver teardown paths. Reboot systems using affected MT7925 devices after updating.

Hi! I’m here to help you understand CVE-2026-89523. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70