CVE-2026-53105: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53105 Overview

CVE-2026-53105 is a NULL pointer dereference vulnerability in the Linux kernel's MediaTek mt7925 Wi-Fi driver. The flaw resides in the mt7925_mac_write_txwi function within the mt76 wireless driver subsystem. The function calls ieee80211_vif_is_mld(vif) without first verifying that the vif (virtual interface) pointer is non-NULL. When the driver processes transmit descriptors in scenarios where vif is not initialized, the kernel dereferences a NULL pointer and panics. The upstream fix adds a NULL check before the access. The issue affects Linux systems using MediaTek MT7925-based Wi-Fi hardware.

Critical Impact
A NULL vif dereference in mt7925_mac_write_txwi can trigger a kernel panic, resulting in a local denial-of-service condition on affected wireless interfaces.

Affected Products

Linux kernel versions containing the mt76/mt7925 Wi-Fi driver prior to the fix commits
Systems using MediaTek MT7925-based wireless network adapters
Linux distributions shipping the unpatched mt76 driver subsystem

Discovery Timeline

2026-06-24 - CVE-2026-53105 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53105

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the MediaTek mt7925 Wi-Fi driver. The mt7925_mac_write_txwi function constructs the Transmit Wireless Information (TXWI) descriptor used by the hardware to transmit frames. During this process, the function invokes ieee80211_vif_is_mld(vif) to determine whether the virtual interface participates in Multi-Link Device (MLD) operation as defined by IEEE 802.11be.

The code path does not validate that vif is non-NULL before dereferencing it inside ieee80211_vif_is_mld. When the driver transmits frames that are not bound to an initialized virtual interface, the kernel reads from a NULL address and panics. The published commits add an explicit vif NULL check before the MLD evaluation.

Root Cause

The root cause is missing input validation on the vif parameter passed into mt7925_mac_write_txwi. The function assumes vif is always initialized, but legitimate driver flows can pass a NULL value. The ieee80211_vif_is_mld helper accesses fields on the structure without performing its own NULL guard, propagating the dereference into a kernel crash.

Attack Vector

Exploitation requires conditions on the local system that cause the mt7925 driver to invoke mt7925_mac_write_txwi with an uninitialized vif. Such conditions can arise during specific transmit scenarios on mt7925 wireless hardware. The outcome is a kernel panic and denial of service on the affected host. There is no indication of memory corruption or code execution from the published advisory and no public exploit is available, with an EPSS probability of 0.168%.

No verified exploit code is available. See the upstream fix commits for technical details: Kernel Git Commit 5d5bdea, Kernel Git Commit 6c52fbd, Kernel Git Commit 815db7f, and Kernel Git Commit 962eb04.

Detection Methods for CVE-2026-53105

Indicators of Compromise

Kernel panic messages referencing mt7925_mac_write_txwi or ieee80211_vif_is_mld in dmesg or /var/log/kern.log
Sudden loss of connectivity on MediaTek MT7925 Wi-Fi interfaces followed by a system reboot
Oops or BUG entries in kernel logs that include a NULL pointer dereference at addresses near zero during Wi-Fi transmit operations

Detection Strategies

Inventory hosts running the mt76 and mt7925 kernel modules using lsmod | grep mt7925 and compare kernel build versions against patched releases
Parse system journals for kernel oops signatures tied to the mt76 driver stack to identify hosts that may have already encountered the bug
Correlate Wi-Fi interface reset events with kernel crash dumps to differentiate this issue from unrelated hardware faults

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on Kernel panic or Oops entries containing mt7925 or ieee80211_vif_is_mld
Track package and kernel versions across the Linux fleet to confirm patched builds have been deployed
Monitor uptime and unexpected reboots on Linux endpoints using MediaTek MT7925 hardware

How to Mitigate CVE-2026-53105

Immediate Actions Required

Update the Linux kernel to a stable release that includes the upstream fix commits listed in the references
Apply distribution-provided kernel security updates on all systems using MediaTek MT7925 Wi-Fi hardware
Reboot affected systems after patching to load the corrected mt76/mt7925 modules

Patch Information

The upstream fix adds a NULL check on vif before calling ieee80211_vif_is_mld(vif) in mt7925_mac_write_txwi. Patched commits are available at Kernel Git Commit 5d5bdea, Kernel Git Commit 6c52fbd, Kernel Git Commit 815db7f, and Kernel Git Commit 962eb04. Consume the fix through your distribution's kernel update channel.

Workarounds

Unload the mt7925e or mt7925u module with modprobe -r on systems that do not require MediaTek MT7925 Wi-Fi connectivity
Blacklist the mt7925 driver in /etc/modprobe.d/ until the patched kernel is installed
Use a wired network connection in place of the affected wireless adapter on impacted hosts

bash

# Configuration example - blacklist the mt7925 driver until patched kernel is applied
echo "blacklist mt7925e" | sudo tee /etc/modprobe.d/blacklist-mt7925.conf
echo "blacklist mt7925u" | sudo tee -a /etc/modprobe.d/blacklist-mt7925.conf
sudo update-initramfs -u
sudo reboot