SB20261023202 - Improper control of a resource through its lifetime in Linux kernel mt76 mt7915 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98957)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through kernel instability.

The vulnerability exists due to improper resource lifetime management in the mt7915e driver's receive NAPI teardown when removing a device, as NAPI remains enabled when it is destroyed. A local privileged user can unload and reload the module on a system using MT7916 hardware to trigger kernel warnings and system instability, potentially causing a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0281dac1e213329b053fb02e612de7f1477a52d7
• https://git.kernel.org/stable/c/0f9afe238eeb79829f0f92f376ba3a20781caccd
• https://git.kernel.org/stable/c/7199ee4b47de0b61fa6455a1587c5ab645ebe262
• https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce