Linux Kernel Wi-Fi MT76 WCID Publication Check Vulnerability

A vulnerability in the Linux kernel's Wi-Fi MT76 driver can lead to a use-after-free condition. This issue arises because the MT7925 MAC station addition function publishes the Wireless Context Identifier (WCID) without proper checks, causing corruption in the station polling list. The vulnerability was introduced in the Linux 7.1 release candidate 4 and affects the stable Linux kernel.

Impact

Exploitation of this vulnerability can cause memory corruption, leading to a use-after-free condition. This type of vulnerability can often be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by using a device with a MediaTek MT7925 Wi-Fi chip and connecting to a wireless access point. The MT7925 MAC station addition function will publish the WCID, which can then be improperly handled by the MT76 driver, causing corruption in the station polling list.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.