CVE-2026-89523

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: cancel pending mlo_pm_work

If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the firmware is not available.

Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown and suspend paths:

  • mt7925_mac_reset_work() (chip reset recovery)
  • mt7925e_unregister_device() (PCIe unbind)
  • mt7925_pci_suspend() (PCIe bus suspend)
  • mt7925_suspend() (mac80211 suspend)
  • mt7925u_suspend() (USB bus / runtime suspend)

This ensures the work is stopped before the device state becomes invalid.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux276a568832577c81ec90b62dc506bbdc3781ca46 < 5be6d02837d418bc6c805b5cab1b338de6de9ca7affected
LinuxLinux276a568832577c81ec90b62dc506bbdc3781ca46 < c5e073f2fbfd34d22099a50d96f60990799753e2affected
LinuxLinux276a568832577c81ec90b62dc506bbdc3781ca46 < 2889e84282dda147f10b10d94cf0efd90a349c53affected
LinuxLinux74eb79258bfd5f2ffe6d26a09c898992b2afa1ceaffected
LinuxLinux6.14.3 < 6.15affected
LinuxLinux6.15affected
LinuxLinux0 < 6.15unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References