CVE-2024-27049

What it actually does

Use-after-free in mt7925e WiFi driver's free_irq() where shared IRQ handler can access resources after deregistration due to missing MT76_REMOVED flag check.

Why it matters to the business

Linux systems with mt7925e hardware face risk of kernel crashes or privilege escalation leading to device downtime and potential compromise until patched.

How an attack unfolds

Attacker triggers IRQ deregistration on affected hardware then induces an unexpected shared IRQ event allowing access to freed memory structures, potentially for code execution.

How to fix it

Upgrade Linux kernel to commit 84470b48af03a818039d587478b415cbcb264ff5 or equivalent fixed versions that set MT76_REMOVED before freeing IRQ resources.

How to confirm the fix worked

Confirm presence of MT76_REMOVED flag logic in mt7925e IRQ handler code and test that shared IRQ events after deregistration are safely ignored without resource access.

Typical attack path

1. Locate Linux system using mt7925e WiFi
2. Cause device removal or IRQ handler deregistration
3. Trigger unexpected IRQ event post-deregistration
4. Leverage freed memory access for crash or exploitation

How to detect it

Review kernel logs for mt76 mt7925e IRQ handler errors, use-after-free warnings, or unexpected device removal events around WiFi activity.

What your security team should do

• Apply kernel update containing the fix to all affected systems
• Prioritize patching due to kernel memory safety impact
• Monitor kernel logs for mt76 driver warnings during device events