A memory corruption vulnerability in the Linux kernel mt76 wifi driver could allow an adjacent attacker to cause system instability or potential code execution.

The vulnerability is caused by an error path in the mt7915 driver that fails to unlink a TWT flow when the MCU rejects an agreement. This leaves a dangling entry in the twt_list, which can lead to memory corruption when the slot is reused, and subsequent list traversal operations may access invalid memory. This is an unauthenticated vulnerability reachable via adjacent network access.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for high impact on system integrity, availability, and confidentiality. Successful exploitation could lead to kernel-level memory corruption, resulting in system crashes (Denial of Service) or potentially facilitating arbitrary code execution within the kernel context. This poses a significant risk to the stability and security of devices utilizing the mt7915 wireless chipset.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.52, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or general protection faults specifically related to the mt76 or mt7915 wireless drivers.

Compensating Controls: Restrict access to wireless network infrastructure to trusted devices and ensure that wireless management frames are protected where possible to limit the attack surface.

Public Exploit Available: No

Given the potential for kernel-level memory corruption and the high CVSS severity, this vulnerability should be prioritized for patching in all environments utilizing affected Linux kernel versions. System administrators should verify their current kernel version and apply the recommended security updates as soon as they become available from their respective distribution maintainers.