Linux Kernel Null Pointer Dereference Vulnerability in Wi-Fi MT76 MT7996 Driver

A null pointer dereference vulnerability has been identified in the Wi-Fi MT76 MT7996 driver of the Linux kernel. This issue arises when a link lacks an assigned channel, causing the function 'mt7996_vif_link' to return NULL. Despite this, the driver still needs to store updated queue settings and apply them later. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, which can cause a denial of service by crashing the kernel or causing the driver to malfunction.

Reproduction

The vulnerability can be reproduced by creating a link in the Wi-Fi MT76 MT7996 driver that does not have an assigned channel. When the driver attempts to update the queue settings for this link, it will encounter a null pointer dereference, causing a crash or malfunction.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.