CVE-2026-74325 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree() after rcu_assign_pointer(NULL). However, rcu_assign_pointer only prevents future RCU readers from obtaining the pointer -- it does not wait for existing readers that already hold it via rcu_dereference.
The TX datapath (e.g. mt7996_mac_write_txwi) dereferences mlink->wcid and mlink->idx under rcu_read_lock. If a TX softirq obtained the pointer via rcu_dereference just before the NULL assignment, it will dereference freed memory after the kfree.
struct mt76_vif_link already contains an rcu_head field that is unused at this free site -- a developer oversight, since the adjacent kfree_rcu_mightsleep call for rx_sc in the same function shows the pattern was understood.
Replace kfree(mlink) with kfree_rcu(mlink, rcu_head).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the mt76 wireless driver component of the Linux kernel, specifically in the mt76_put_vif_phy_link function where improper memory management creates a potential use-after-free condition. The flaw occurs when the function attempts to free an offchannel mlink structure using plain kfree() after setting the pointer to NULL with rcu_assign_pointer(). This pattern fails to account for the fundamental RCU (Read-Copy-Update) mechanism which only prevents new readers from accessing the pointer but does not synchronize with existing readers who may still hold references to the memory. The vulnerability represents a classic race condition where the timing window between rcu_assign_pointer() and kfree() allows concurrent execution paths to access freed memory, leading to potential system instability or security exploitation.
The technical implementation flaw stems from the improper handling of RCU-protected data structures within the wireless driver's virtual interface management code. The TX datapath functions such as mt7996_mac_write_txwi perform rcu_read_lock() operations when dereferencing mlink->wcid and mlink->idx fields, creating a scenario where a softirq thread might have obtained a reference to the mlink structure via rcu_dereference() before the NULL assignment occurred. When the memory is subsequently freed with kfree(), any ongoing TX processing that holds the reference will attempt to access deallocated memory, resulting in undefined behavior and potential kernel crashes. This error pattern aligns with CWE-415: Double Free and CWE-416: Use After Free vulnerabilities, where improper memory lifecycle management leads to memory corruption.
The operational impact of this vulnerability extends beyond simple system instability into potential security implications within wireless network operations. When exploited, the use-after-free condition could allow malicious actors to manipulate wireless transmission parameters or potentially escalate privileges through kernel memory corruption. The issue affects systems utilizing MediaTek mt76 wireless chipsets including but not limited to the mt7996 SoC, making it relevant to a broad range of embedded devices, routers, and IoT equipment that depend on Linux kernel wireless functionality. The vulnerability is particularly concerning in environments where wireless network reliability is critical, as it could lead to complete wireless service disruption or create attack vectors for more sophisticated exploits.
The proper mitigation involves implementing the correct RCU memory management pattern by replacing the plain kfree() call with kfree_rcu(mlink, rcu_head) as suggested in the fix. This change ensures that the memory deallocation waits for all active RCU readers to complete their operations before freeing the structure, maintaining the integrity of concurrent access patterns. The solution leverages the existing rcu_head field within the struct mt76_vif_link structure that was previously unused, indicating this was likely a developer oversight rather than a fundamental architectural limitation. This approach aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation and follows the established kernel memory management best practices outlined in the Linux kernel documentation for RCU implementation. The fix demonstrates proper adherence to the kernel's memory management protocols and ensures that all concurrent access patterns are properly synchronized, preventing both immediate crashes and potential security exploitation scenarios.