CVE-2025-38155

What it actually does

Null pointer dereference in mt7915_mmio_wed_init() because the return value of devm_ioremap() is not checked before use, leading to a kernel crash when memory mapping fails.

Why it matters to the business

Linux systems with mt7915 WiFi hardware can experience sudden kernel panics and reboots, causing service interruptions and potential loss of unsaved work on servers and embedded devices.

How an attack unfolds

An attacker triggers device initialization under conditions where devm_ioremap fails (for example, resource exhaustion or hardware misconfiguration), causing the unchecked NULL return value to be dereferenced inside mt7915_mmio_wed_init and crashing the kernel; observed threat actors have targeted similar Linux kernel memory issues for denial-of-service or escalation chains.

How to fix it

Upgrade the Linux kernel to a version containing commit e9f9cef1877ac32285dbc1f31b86c8955b712fc2; apply the upstream patch that adds an explicit NULL check after devm_ioremap in mt7915_mmio_wed_init.

How to confirm the fix worked

Inspect the mt7915_mmio_wed_init function in the running kernel source or binary for the presence of a NULL check immediately after the devm_ioremap call; confirm the kernel commit or package version matches the fixed revision.

Typical attack path

1. Obtain local or privileged access to a system with mt7915 hardware
2. Force or wait for mt7915_mmio_wed_init execution path
3. Induce devm_ioremap failure so it returns NULL
4. Execute the missing NULL check code path resulting in dereference and panic

How to detect it

Search kernel logs, dmesg output, and crash dumps for strings indicating a null pointer dereference originating from mt7915_mmio_wed_init or the mt76/mt7915 driver; correlate with hardware initialization events.

What your security team should do

• Apply the kernel fix containing commit e9f9cef1877ac32285dbc1f31b86c8955b712fc2 on all affected systems within standard maintenance windows
• Monitor kernel logs for oops/panic messages referencing mt7915_mmio_wed_init or mt76 driver
• Restrict untrusted local access on systems exposing mt7915 hardware until patched