CVE-2025-38156

What it actually does

Unchecked return value from devm_ioremap() in mt7996_mmio_wed_init() leads to NULL pointer dereference during MediaTek mt7996 Wi-Fi MMIO WED initialization.

Why it matters to the business

Kernel crash or denial of service on systems using the affected mt7996 wireless hardware; low exploitation likelihood but requires prompt kernel updates on affected Linux distributions.

How an attack unfolds

An attacker with local access or the ability to influence driver loading and hardware configuration triggers the mt7996_mmio_wed_init path where ioremap fails, causing an immediate NULL dereference and system instability.

How to fix it

Update the Linux kernel to a version containing commit 1072fc0ca1f8d0d5397d24853386876f937b8e63 or later; apply distribution-specific backports for stable branches.

How to confirm the fix worked

Verify kernel source contains the referenced commit or test that mt7996_mmio_wed_init() now checks the devm_ioremap return value before use; confirm no NULL dereference occurs under simulated ioremap failure.

Typical attack path

1. Obtain local access or control over driver initialization conditions
2. Cause or wait for mt7996_mmio_wed_init() execution during Wi-Fi device probe
3. Ensure devm_ioremap() returns NULL (e.g., resource conflict or allocation failure)
4. Trigger NULL pointer dereference leading to kernel panic or oops

How to detect it

Search kernel logs and dmesg for mt7996_mmio_wed_init references, NULL pointer dereference oops, or panic traces involving the mt76 driver; correlate with Wi-Fi device probe events.

• mt7996_mmio_wed_init
• NULL pointer dereference.*mt76
• devm_ioremap.*mt7996

What your security team should do

• Apply the kernel fix containing commit 1072fc0ca1f8d0d5397d24853386876f937b8e63 immediately on all systems with mt7996 hardware
• Monitor kernel logs for mt7996-related oops or NULL pointer dereference events
• Prioritize updates on servers and workstations exposing wireless interfaces