CVE-2026-89523: Linux Kernel mt76 Use-After-Free Vulnerability

CVE-2026-89523 Overview

CVE-2026-89523 is a use-after-free vulnerability in the Linux kernel mt76 driver for MediaTek MT7925 Wi-Fi chipsets. The flaw exists because delayed work item mlo_pm_work was not cancelled during device reset, suspend, or unregister paths. A pending workqueue callback can execute after the associated virtual interface (vif) or Basic Service Set (BSS) data has been freed, or attempt to issue Microcontroller Unit (MCU) commands when firmware is no longer available. The upstream fix adds cancel_delayed_work_sync(&dev->mlo_pm_work) to all teardown and suspend paths in the driver.

Critical Impact
A local attacker who can trigger driver reset, suspend, or device unbind sequences may achieve kernel memory corruption leading to privilege escalation or a denial-of-service condition.

Affected Products

Linux kernel builds shipping the mt76 wireless driver with mt7925 support
Systems using MediaTek MT7925 PCIe Wi-Fi adapters
Systems using MediaTek MT7925 USB Wi-Fi adapters

Discovery Timeline

2026-09-11 - CVE-2026-89523 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89523

Vulnerability Analysis

The mt76 driver schedules a delayed workqueue item, mlo_pm_work, to handle Multi-Link Operation (MLO) power management tasks for MT7925 devices. If the device transitions to a reset, suspend, or unregister state while mlo_pm_work remains queued, the callback can run against invalidated driver state. The callback references vif and bss structures that mac80211 may have already freed during teardown. It can also invoke MCU command paths when the firmware has been torn down, producing undefined behavior in kernel context.

The upstream commits add cancel_delayed_work_sync(&dev->mlo_pm_work) to mt7925_mac_reset_work(), mt7925e_unregister_device(), mt7925_pci_suspend(), mt7925_suspend(), and mt7925u_suspend(). This guarantees the work item completes or is cancelled before further teardown proceeds.

Root Cause

The root cause is a lifetime mismatch between the delayed work item and the driver objects it references. The driver enqueues mlo_pm_work without ensuring it is synchronously cancelled during every teardown path. This creates a classic use-after-free race condition in kernel-mode code, where freed memory backing vif or bss state can be dereferenced by the workqueue thread.

Attack Vector

Exploitation requires local access with the ability to trigger a Wi-Fi driver reset, initiate system suspend, or force PCIe/USB unbind on the MT7925 device. An unprivileged local user with permission to trigger suspend or rfkill events, or a low-privilege attacker able to induce a firmware reset by malformed traffic reception, can widen the race window. Successful exploitation of the freed vif/bss dereference can corrupt kernel memory, potentially yielding code execution at ring 0.

No verified public exploit code is available. The technical fix is documented across three upstream kernel commits referenced in the Kernel Git commit 2889e842, Kernel Git commit 5be6d028, and Kernel Git commit c5e073f2.

Detection Methods for CVE-2026-89523

Indicators of Compromise

Kernel oops or panic entries in dmesg originating from mt7925_mlo_pm_work or adjacent mt76 symbols following a suspend, resume, or interface teardown event.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free access to ieee80211_vif or ieee80211_bss_conf structures during Wi-Fi driver activity.
Repeated Wi-Fi firmware reset events (mt7925_mac_reset_work) followed by unexpected interface disappearance or system instability.

Detection Strategies

Enable KASAN on test kernels running affected MT7925 hardware to surface the use-after-free during suspend/resume and rmmod cycles.
Monitor kernel log ingestion pipelines for MCU command failures or NULL pointer dereference traces tied to mt76/mt7925 modules.
Inventory Linux endpoints using modinfo mt7925e and modinfo mt7925u to identify hosts that require the patched driver.

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel messages to a centralized data lake for correlation of kernel faults across the fleet.
Alert on kernel modules being reloaded unexpectedly on systems shipping MT7925 hardware, which may indicate exploitation attempts against the race window.
Track system suspend/resume telemetry alongside crash dumps to identify hosts consistently hitting the flawed teardown path.

How to Mitigate CVE-2026-89523

Immediate Actions Required

Upgrade the Linux kernel to a version incorporating the three upstream mt76: mt7925: cancel pending mlo_pm_work commits.
Apply distribution-provided kernel security updates for RHEL, Debian, Ubuntu, SUSE, and other supported vendors as they publish backports.
Restrict local shell access on multi-user systems using vulnerable MT7925 hardware until patches are deployed.

Patch Information

The fix is delivered by three upstream commits: 2889e842, 5be6d028, and c5e073f2. Each adds cancel_delayed_work_sync(&dev->mlo_pm_work) in the reset, unregister, PCIe suspend, mac80211 suspend, and USB suspend code paths. Rebuild and reload the mt7925e or mt7925u module after applying the patched kernel.

Workarounds

Blacklist the mt7925e and mt7925u modules on systems where Wi-Fi is not required by adding entries to /etc/modprobe.d/.
Disable system suspend and hibernation on affected hosts to reduce the number of teardown paths that can trigger the race.
Use a wired network connection and administratively disable the Wi-Fi radio via rfkill until patched kernels are installed.

bash

# Blacklist the vulnerable MT7925 driver modules until patched
echo 'blacklist mt7925e' | sudo tee /etc/modprobe.d/blacklist-mt7925.conf
echo 'blacklist mt7925u' | sudo tee -a /etc/modprobe.d/blacklist-mt7925.conf
sudo rmmod mt7925e 2>/dev/null
sudo rmmod mt7925u 2>/dev/null
sudo update-initramfs -u