CVE-2026-74325

A flaw was found in the wifi: mt76 driver within the Linux kernel. This vulnerability occurs because the mt76_put_vif_phy_link function improperly deallocates memory for offchannel links. An attacker could exploit this by causing the system to access memory after it has been freed, leading to a use-after-free condition. This could result in a system crash (denial of service) or potentially allow for arbitrary code execution.

mt76 offchannel link removal can create an RCU use after free because rcu_assign_pointer clears mvif offchannel_link but the object is then released with kfree while existing RCU readers may still hold the old pointer. The TX datapath can dereference mlink wcid or mlink idx under rcu_read_lock after another context has freed the same mlink object, which can crash the kernel and may create a memory corruption candidate. For the CVSS the PR:L is used for the paranoid score because reliable triggering may be possible for a local user or local service that can generate WiFi activity while the system performs offchannel or remain_on_channel operations, even if full administrative control is not always required in real deployments. The issue is not directly reachable from the Internet, but a nearby WiFi peer may influence the TX path on affected mt76 hardware while the vulnerable lifetime race is controlled by local wireless state changes. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel UAF behavior, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.