CVE-2026-53105: Linux Kernel MT7925 WiFi Driver Null Pointer Dereference DoS

Technical summary

CVE-2026-53105 is a null pointer dereference vulnerability (CWE-476) in the mt7925_mac_write_txwi function within the Linux kernel's mt76 WiFi driver. The flaw occurs when the function attempts to call ieee80211_vif_is_mld() on a vif (virtual interface) pointer without validating that the pointer is non-null first. In scenarios where a vif is not properly initialized, this results in a kernel panic. The vulnerability requires local access and unprivileged execution context to exploit, making it a lower-privilege attack surface compared to remote network-based exploits.

Business impact

Systems running affected Linux kernel versions with MT7925 wireless hardware face localized availability risk. A local, unprivileged user can force a kernel panic, temporarily rendering the device unreachable over the network or unusable for its primary function. In enterprise environments with shared Linux systems, this could be weaponized by a lower-privileged account holder to disrupt service. However, the impact is containable through standard system restart procedures; no data confidentiality or integrity compromise occurs.

Affected systems

This vulnerability affects the Linux kernel across all maintained versions that include the mt76 driver with MT7925 chipset support. Systems using Mediatek MT7925 WiFi cards—commonly found in laptops, embedded systems, and network appliances—are in scope. You can verify your system's inclusion by checking kernel version and confirming mt7925 is loaded via lsmod or reviewing your device's wireless hardware specifications. Verify against your kernel release notes and vendor advisory for the exact versions addressed by upstream Linux kernel patches.

Exploitability

Exploitation requires local system access and unprivileged user privileges. An authenticated local user can craft conditions to invoke mt7925_mac_write_txwi with a null vif pointer, triggering the panic. No network interaction, authentication bypass, or privilege escalation is required as a prerequisite. The barrier to exploitation is low for anyone with shell access, but the impact is non-persistent denial of service only. No known public exploits are referenced in active threat tracking databases.

Remediation

Apply the upstream Linux kernel patch that adds null-pointer validation to mt7925_mac_write_txwi before the ieee80211_vif_is_mld() call. Most Linux distributions derive patches from upstream kernel development; check your vendor's security advisory for the specific kernel version containing this fix. Systems should be updated to the earliest patched kernel version available for your distribution. Kernel module recompilation or driver rebuild may be necessary if you maintain a custom kernel configuration.

Patch guidance

Identify your current Linux kernel version using `uname -r`. Cross-reference your kernel version against your distribution's security advisory or the upstream Linux kernel security database to determine if a patched version is available. For RHEL, Ubuntu, Debian, and other major distributions, kernel security updates are typically delivered as standard patch packages. Install the updated kernel package and reboot. Verify the fix by confirming the new kernel is running post-reboot and that mt7925 loads without additional errors in dmesg.

Detection guidance

Monitor system logs for kernel panic messages or oops events involving mt7925_mac_write_txwi, particularly those referencing null pointer dereferences. On systems where syslog or journalctl are active, search for entries like 'NULL pointer dereference at' combined with mt7925 or mt76 driver context. Kernel crash dumps, if available, will show the exact stack trace. Proactive detection is difficult without instrumentation; focus detection efforts on systems where the vulnerability window is known (unpatched kernel versions with MT7925 driver). Consider host-based monitoring that flags unexpected kernel panics correlating with wireless driver activity.

Why prioritize this

While the CVSS score of 5.5 (Medium) reflects limited scope and unprivileged access requirement, this vulnerability merits prompt attention because kernel-level denial-of-service flaws in wireless drivers are operationally disruptive in any environment. For organizations with remote workers using affected laptops or for edge devices relying on MT7925 connectivity, a single exploitation event forces a full system restart and service interruption. Prioritize patching any systems where MT7925 is the primary or sole wireless interface, and where local user access is a realistic threat model.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), unprivileged user requirement (PR:L), and no user interaction needed (UI:N). The scope is unchanged (S:U), and the impact is high availability loss (A:H) with no confidentiality or integrity impact. This is a straightforward DoS without escalation or multi-stage requirements, placing it solidly in the Medium severity range. The score accurately captures that while impact is severe (system unavailability), the attack is bounded by local-only access.

Frequently asked questions