CVE-2025-38009

What it actually does

Failure to disable tx NAPI before deletion in mt76_dma_cleanup() triggers a kernel warning in __netif_napi_del_locked during module unload for mt76-based WiFi drivers.

Why it matters to the business

Driver removal on affected Linux systems produces kernel warnings that can pollute logs, complicate troubleshooting, and indicate incomplete resource cleanup; widespread use of mt76 hardware increases exposure across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access loads or unloads the mt76 kernel module (via modprobe or device removal) to trigger the NAPI shutdown path; the missing napi_disable call before __netif_napi_del_locked produces the warning but does not yield code execution or privilege gain.

How to fix it

Update the Linux kernel to a version containing commit ff0f820fa5b99035b3c654dd531226d8d83aec5f or later; rebuild and reinstall any out-of-tree mt76 modules after the update.

How to confirm the fix worked

Confirm the fix by unloading the mt76 module and verifying absence of the __netif_napi_del_locked warning; check kernel git history for the referenced commit or verify the mt76_dma_cleanup() function disables tx napi before deletion.

Typical attack path

1. Obtain local shell or sufficient privileges to manage kernel modules
2. Trigger mt76 driver removal through modprobe -r, PCI hot-unplug, or system shutdown
3. Observe resulting kernel warning in dmesg or logs

How to detect it

Search kernel logs and dmesg for the string __netif_napi_del_locked and the mt76_dma_cleanup call stack around module unload events; correlate with modprobe or pci_device_remove activity.

What your security team should do

• Prioritize kernel updates on systems using mt76 WiFi hardware within normal patch cycles
• Monitor dmesg and kernel logs for NAPI-related warnings during driver lifecycle events
• Test driver unload paths in staging or lab environments before broad deployment