Cloudanix VulnDB

CVE-2026-98957

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug can make certain wireless network cards cause the whole computer to become unstable when the wireless settings are changed.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Failure to disable RX NAPI before destroying the NAPI structure during mt7915e module unload on MT7916 hardware triggers use-after-free conditions in __netif_napi_del_locked and page_pool_disable_direct_recycling.

Why it matters to the business

Wireless driver reloads for configuration changes such as 6 GHz enablement cause kernel instability or crashes on affected MediaTek hardware, disrupting network connectivity until the system is rebooted.

How an attack unfolds

An attacker with local privileges unloads the mt7915e module on MT7916 devices; the missing RX NAPI disable allows freed structures to be accessed by pending RX handlers, producing warnings and leaving the system unstable for subsequent module reinsertion.

How to fix it

Apply the upstream fix that calls napi_disable on the RX NAPI instance inside mt7915_stop_hardware before any device teardown; rebuild and deploy the patched kernel or backported module.

How to confirm the fix worked

Unload and reload the mt7915e module while monitoring dmesg for absence of __netif_napi_del_locked and page_pool_disable_direct_recycling warnings; confirm clean module removal and reinsertion succeeds.

Typical attack path

  1. Obtain local root or CAP_SYS_MODULE privileges
  2. Unload the mt7915e kernel module
  3. Trigger RX path access to already-freed NAPI structures
  4. Observe kernel warnings and resulting instability

How to detect it

Search kernel logs and dmesg for repeated warnings referencing __netif_napi_del_locked or page_pool_disable_direct_recycling immediately after mt7915e module removal attempts.

  • __netif_napi_del_locked
  • page_pool_disable_direct_recycling
  • mt7915e: napi warnings during unload

What your security team should do

  • Prioritize kernel update containing the napi-disable change within the next maintenance window
  • Restrict module unload privileges to trusted administrators until patched
  • Add kernel log monitoring for napi-related warnings on wireless systems

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in __netif_napi_del_locked() and in page_pool_disable_direct_recycling() because the driver does not disable the napi before destroying it. This is troublesome since on MT7916 it is required to unload the module and reinsert it with a different enable_6ghz parameter to change the frequency. The system generally becomes unstable after reinserting the module. Fix it by disabling rx napi inside mt7915e itself, even through napi rx is enabled in the mt76 generic code. Disabling it in the mt76 generic code was previously attempted and reverted because napi was disabled too late and rx handlers could access freed structures. Note that the tx side is enabled and disabled by the mt76 generic code. It is disabled in mt7915_stop_hardware() since, unlike mt7915_unregister_device(), is it also called in the probe path if an error happens after rx napi is enabled.

Affected packages

Ecosystem Package Introduced Fixed