CVE-2026-53105

What it actually does

This flaw is a NULL pointer dereference in the Linux kernel mt76 wireless driver for MediaTek MT7925 Wi-Fi hardware. In mt7925_mac_write_txwi, the driver could call ieee80211_vif_is_mld(vif) before confirming that the vif pointer was initialized. If the vulnerable code path is reached while vif is NULL, the kernel may dereference address zero, causing a kernel oops, panic, interface failure, or system reboot. The primary impact is denial of service rather than code execution, and no public exploit maturity is currently indicated.

Why it matters to the business

Systems using affected Linux kernels with MediaTek MT7925 Wi-Fi hardware may become unstable or unexpectedly reboot if the vulnerable driver path is triggered. For laptops, workstations, edge devices, or embedded systems that rely on Wi-Fi connectivity, this can cause user disruption, loss of network availability, interrupted operations, and potential data loss from abrupt crashes. The current EPSS is very low and the issue is not listed in CISA KEV, so broad exploitation urgency is lower than for actively exploited vulnerabilities, but kernel-level stability issues should still be corrected through normal patch cycles.

How an attack unfolds

An attacker would need a way to trigger the vulnerable mt7925 transmit path while the kernel driver is operating with an uninitialized or absent virtual interface pointer. In practical terms, this is most relevant on systems that load the mt76/mt7925 driver and use MediaTek MT7925 Wi-Fi hardware. The attacker may attempt to influence Wi-Fi state transitions, traffic generation, connection handling, multi-link operation behavior, or interface teardown/setup timing so that mt7925_mac_write_txwi is reached with vif set to NULL. When the driver evaluates ieee80211_vif_is_mld(vif) without a prior NULL check, the kernel dereferences the NULL pointer and may crash or panic. There is no indication from the provided data that this enables privilege escalation, persistent compromise, ransomware use, or remote code execution.

How to fix it

Update to a Linux kernel build that includes the upstream fix adding a NULL check before ieee80211_vif_is_mld(vif) in the mt7925 driver. Because exact fixed package versions were not provided, use the latest security-supported kernel from the relevant Linux distribution, device vendor, or kernel maintenance branch. Where immediate patching is not possible, reduce exposure by disabling the affected mt7925 Wi-Fi device, using wired networking, removing or blacklisting the mt7925/mt76 driver where operationally acceptable, or avoiding unstable Wi-Fi workflows that repeatedly create and destroy wireless interfaces. Reboot systems after kernel updates to ensure the fixed driver is loaded.

How to confirm the fix worked

Confirm exposure by checking whether the system uses MediaTek MT7925 Wi-Fi hardware and loads mt76/mt7925-related kernel modules. Validate remediation by verifying the running kernel version is the vendor-fixed version, not merely that the package is installed. Confirm the patched source or vendor changelog includes the NULL vif check in mt7925_mac_write_txwi. After patching and rebooting, verify the mt7925 wireless interface functions normally and monitor kernel logs for absence of new NULL pointer dereference, kernel oops, or panic messages associated with mt7925, mt76, mt7925_mac_write_txwi, or ieee80211_vif_is_mld.

Typical attack path

1. Identify a Linux system using MediaTek MT7925 Wi-Fi hardware and a vulnerable kernel containing the affected mt76/mt7925 driver code.
2. Cause or wait for Wi-Fi activity that reaches the mt7925 transmit descriptor generation path.
3. Trigger edge-case timing or state conditions involving Wi-Fi interface initialization, teardown, association, roaming, or multi-link related handling where the driver may operate without a valid vif pointer.
4. The vulnerable function mt7925_mac_write_txwi calls ieee80211_vif_is_mld(vif) while vif is NULL.
5. The kernel encounters a NULL pointer dereference, leading to an oops, driver failure, kernel panic, reboot, or loss of wireless service.

How to detect it

To determine whether the issue may already have been triggered, review kernel logs, persistent journal entries, crash dumps, and system reboot records for NULL pointer dereference, kernel oops, panic, or watchdog events involving the mt76/mt7925 Wi-Fi driver. Useful sources include journalctl -k output, /var/log/kern.log, /var/log/messages, /var/crash, kdump/vmcore repositories, distribution crash reporting tools, endpoint telemetry, and system uptime/reboot history. Correlate crash times with Wi-Fi interface resets, association/disassociation events, suspend/resume, roaming, module reloads, or network manager activity. Because the described flaw is a denial-of-service condition and no exploit maturity is indicated, evidence will usually look like kernel instability rather than attacker persistence. Look specifically for function names mt7925_mac_write_txwi and ieee80211_vif_is_mld, module names mt7925e or mt76, and generic NULL pointer dereference or kernel panic messages near wireless driver events.

• mt7925_mac_write_txwi
• ieee80211_vif_is_mld
• BUG: kernel NULL pointer dereference
• NULL pointer dereference
• Kernel panic - not syncing
• Oops: 0000
• mt7925e
• mt76
• mt7925
• /var/log/kern.log
• /var/log/messages
• /var/crash
• /proc/modules

What your security team should do

• Prioritize patching Linux endpoints and devices that use MediaTek MT7925 Wi-Fi hardware, especially mobile workstations, kiosks, edge systems, and devices where unexpected reboot has operational impact.
• Inventory systems for loaded mt76/mt7925 drivers and MT7925 PCI/USB wireless hardware to determine actual exposure before broad remediation campaigns.
• Deploy the latest vendor-supported kernel containing the mt7925 NULL pointer dereference fix and reboot affected systems.
• If patching is delayed, consider disabling or blacklisting the affected Wi-Fi driver on high-availability systems and use alternate networking where feasible.
• Monitor kernel logs and crash telemetry for NULL pointer dereferences or panics involving mt7925_mac_write_txwi, ieee80211_vif_is_mld, mt7925, or mt76.
• Treat observed crashes as potential availability incidents, but do not assume compromise unless accompanied by separate indicators of unauthorized access or persistence.