CVE-2022-48705

What it actually does

Race condition in mt7921e WiFi driver causes kernel crash during repeated mac_reset attempts when drv own fails, due to napi_disable() being called without re-enabling tx_napi, leaving the thread parked indefinitely.

Why it matters to the business

Systems using mt7921e hardware may experience unexpected kernel panics and reboots during WiFi chip reset operations, leading to service interruptions on affected Linux deployments.

How an attack unfolds

An attacker or environmental condition triggers repeated driver-own failures during chip reset (e.g., via hardware timing or interference), causing the mt7921_mac_reset_work queue to hit the napi_disable() hang and produce a kernel warning and crash.

How to fix it

Apply the upstream fix in commit f7f3001723e337568017e8617974f29bc8b2f595 or later; update to a kernel containing this change for all affected mt7921e devices.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source; reproduce drv-own-failure reset sequences and verify absence of the kthread_park warning and crash.

Typical attack path

1. Trigger conditions that cause drv own failure in mt7921e reset path
2. Invoke mac_reset multiple times without proper napi state synchronization
3. Hit kthread_park warning and subsequent crash in mt7921e_mac_reset

How to detect it

Search kernel logs and dmesg for repeated 'driver own failed', 'Timeout for driver own', and the mt7921_mac_reset_work call trace leading to kthread_park warnings.

• driver own failed
• Timeout for driver own
• mt7921e_mac_reset+0x176/0x6f0
• mt7921_mac_reset_work+0x184/0x3a0
• WARNING: CPU.*at kernel/kthread.c.*kthread_park

What your security team should do

• Prioritize kernel updates containing f7f3001723e337568017e8617974f29bc8b2f595 on all systems with mt7921e hardware
• Monitor kernel logs for 'driver own failed' and 'Timeout for driver own' messages
• Test WiFi reset paths in staging environments after patching