A use‑after‑free bug exists in the mt76 driver for the MT7996 PCIe wireless chip in the Linux kernel. When the device is removed, its crash data structure is freed while a pending work item continues to reference it, leading to undefined kernel behavior. The bug can corrupt memory, cause a kernel panic or result in a denial of service. The vulnerability is limited to local kernel context and would require a privileged user to trigger the device removal or hot‑plug scenario.

All Linux kernel builds that include the mt76 driver for MT7996 wireless devices and lack the recent patch that cancels pending work before freeing the crash data. The specific kernel version is not listed, but any kernel older than the commit that introduced cancel_work_sync in mt7996_unregister_device is affected.

The exploit is local; an attacker with kernel or privileged user rights can trigger device detachment to cause a use‑after‑free. No remote network vector is indicated. The EPSS score is not available and the issue is not listed in CISA KEV, so the measurable risk exposure is currently unclear, but kernel crashes directly impact availability and could enable privilege escalation if memory corruption is exploitable further.