CVE-2026-89523

The Linux kernel's mt76 driver for MediaTek MT7925 Wi-Fi chipsets fails to cancel a pending delayed work item (mlo_pm_work) when the device is reset, suspended, or unregistered. If the work runs after teardown has begun, it accesses vif/bss structures that may already be freed, or issues MCU commands while firmware is unavailable, creating a use-after-free race reachable via chip reset recovery, PCIe/USB suspend, or device unbind. A local attacker with low privileges who can time suspend/resume cycles or trigger a reset could exploit this to crash the kernel (denial of service) or potentially execute code with kernel-level privileges, reflected in the high confidentiality/integrity/impact ratings. Affected systems are Linux machines using MT7925 Wi-Fi hardware through the mt7925 driver (PCIe and USB variants) in kernels that predate the fix. No public proof-of-concept exists and no exploitation has been observed.

What to do: Upgrade to a kernel release or vendor package that includes the fix, which adds cancel_delayed_work_sync(&dev->mlo_pm_work) to mt7925_mac_reset_work, mt7925e_unregister_device, and the PCIe/USB/mac80211 suspend paths; track your distribution's stable kernel advisories for the backport. There is no configuration-level workaround, but the attack requires local access, so restricting untrusted local accounts limits risk. Watch for kernel panics, splats, or WARNING traces from mt7925 during suspend/resume or firmware reset recovery as an indicator of hitting the race.