CVE-2021-47028

What it actually does

Missing validation of rate_info structure in the mt7915 wireless driver allows invalid data to reach cfg80211_calculate_bitrate during ieee80211_tx_status_ext processing, producing incorrect bitrate values or triggering kernel faults.

Why it matters to the business

Wireless devices using mt7915 hardware may experience driver crashes or degraded network reporting, leading to intermittent connectivity loss and unplanned reboots on affected Linux systems.

How an attack unfolds

An attacker sends or influences 802.11 frames that produce unusual transmission rates; the driver path through mt7915_mac_tx_free and mt7915_mcu_get_rx_rate then passes unchecked rate_info to the mac80211 and cfg80211 layers, causing unexpected reporting or a crash.

How to fix it

Apply the upstream kernel commit that adds the rate_info validation check in the mt76/mt7915 driver; rebuild and deploy updated kernels or firmware packages containing the fix.

How to confirm the fix worked

Inspect dmesg or kernel logs after wireless TX activity for absence of the original call trace; confirm the presence of the proper rate_info guard in cfg80211_calculate_bitrate and ieee80211s_update_metric paths.

Typical attack path

1. Establish or manipulate a wireless association with an mt7915-based device
2. Induce transmission conditions that populate rate_info with unexpected values
3. Trigger ieee80211_tx_status_ext via normal or crafted traffic
4. Reach the unchecked calculation path resulting in kernel fault

How to detect it

Search kernel logs and dmesg for the call trace symbols involving cfg80211_calculate_bitrate, ieee80211s_update_metric, mt7915_mcu_get_rx_rate, and mt7915_mac_tx_free around the time of wireless interface activity.

• cfg80211_calculate_bitrate+0x124/0x200 [cfg80211]
• ieee80211s_update_metric+0x80/0xc0 [mac80211]
• mt7915_mcu_get_rx_rate+0x28c/0x8d0 [mt7915e]
• mt7915_mac_tx_free+0x324/0x7c0 [mt7915e]

What your security team should do

• Prioritize kernel updates for systems with mt7915 hardware
• Monitor syslog and dmesg for wireless driver stack traces
• Isolate or replace affected wireless adapters where updates cannot be applied quickly