CVE Vulnerability Catalog

There is an error in non-AQL packet accounting for MLO stations in the mt76 driver. The function overrides the wcid passed by the driver, causing the counter to be updated on the wrong wcid. Once the limit is exceeded, the scheduler may permanently refuse to service the station.

In the mt7996 driver, there is a missing validation of the band_idx field in the RX descriptor. The field (2 bits) can be invalid and cause out-of-bounds access to the phys[] array or a NULL dereference, potentially leading to crashes.

In the mt7915 driver, there is a race condition when clearing the wcid mask in remove_interface(). The mask is cleared without holding the mutex and before clearing the RCU pointer, which can lead to wcid leaks, double allocation, or even removal.

In the mt7915 driver, there is an underflow when calculating the number of spatial streams. If the MCS map has no supported streams, the function returns 255, which is written into the firmware's beamforming fields.

In the mt76 driver, there is a race in RXDMAD_C buffer recycling. These buffers come from page pools tied to a different NAPI, so direct recycling can race with the owning NAPI, leading to errors.

In the mt7996 driver, there is a bug in the TLV walk in mt7996_mcu_get_chip_config. The loop advances by tlv->len without a minimum, so a zero-length TLV could cause an infinite loop, and an out-of-bounds read is also possible.

In mt76 drivers, the mmio_write_copy and mmio_read_copy functions iterate up to ALIGN(len,4), so a length not a multiple of four reads past the source buffer or writes past the destination.

In the Linux kernel, mt7915_add_interface() in the mt76 wifi driver fails to unwind state when adding an interface fails. When mt76_wcid_alloc() fails, the function returns without clearing the vif_mask/omac_mask bits it set, without removing the firmware dev info added earlier, and without clearing a monitor_vif pointer to a vif mac80211 is about to free. Since mac80211 does not call remove_interface() for a failed add, indices and the firmware dev entry leak permanently and testmode could dereference the stale monitor_vif.

In the Linux kernel, mt7996_mac_reset_work() in the mt76 wifi driver (mt7996) parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. Since mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex, an L1 SER racing a channel switch could leave the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens.

In the Linux kernel, mt7996_mcu_beacon_cntdwn() in the mt76 wifi driver (mt7996) emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template, the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic().

In the Linux kernel, both mt76 wifi drivers cancelled dump_work on unregister but left reset_work and rc_work to be flushed only by destroy_workqueue() in mt76_free_device(), which runs after the hw is unregistered and the hardware stopped. A reset_work that fires in that window calls ieee80211_restart_hw() and re-arms mac_work on an unregistered hw, and rc_work touches station state being torn down.

In the Linux kernel, acpi_processor_driver_init() registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driver_register() or cpuhp_setup_state() fails, the error path only unregisters the ACPI processor driver and the idle driver, leaving the cpufreq notifier registered even though initialization failed.

In the Linux kernel, MDP4/MDP5 MSM display drivers double-free KMS state during failed initialization, causing a use-after-free. The error path in msm_drm_init() calls cleanup again after the driver already destroyed the KMS, leading to a crash.

In the Linux kernel, the drm/msm/dsi driver calls dev_pm_opp_set_rate(0), which removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. The fix drops the explicit call; every call site of ops->link_clk_disable() is followed by pm_runtime_put(), so the power vote will be rescinded if deemed safe.

In the Linux kernel, ath11k_service_ready_ext_event() in the ath11k wifi driver can allocate svc_rdy_ext.mac_phy_caps during TLV parsing. This is a temporary allocation freed on the success path but not on the error path — if parsing succeeds far enough to allocate mac_phy_caps and then fails on a later TLV, the allocation leaks.

In the Linux kernel, regulator_init_complete_work uses schedule_delayed_work() with system_wq, which is non-freezable, allowing it to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C; when it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer().

In the Linux kernel, btf_distill_func_proto() builds the function model used for fentry/fexit/fmod_ret/fsession trampolines and struct_ops, having accepted a 16-byte __int128 return value since the trampoline was introduced. However, the BPF trampoline preserves only 8 bytes of the return value (RAX/R0), so for attach types that read the target's return value (fexit, fmod_ret, fsession plus their _multi variants, and struct_ops) the second half is neither saved nor restored, corrupting the value seen by the real caller.

In the Linux kernel, btf_distill_func_proto() accepts function arguments up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. The current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

In the mt76 wifi driver (mt7915), the TWT flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind.

In the mt76 wifi driver (mt7996), mt7996_mac_reset_vif_iter() queues non-default vif links for kfree_rcu while dev->wcid[] still holds pointers to the wcid embedded in each freed link. mt76_reset_device() then dereferences those entries and runs mt76_wcid_cleanup() on them; if a grace period elapses in between, the cleanup operates on freed memory.