A use‑after‑free bug exists in the mt76 driver for the MT5996 wireless chip in the Linux kernel. When the device is removed, its crash data structure is freed while a pending work item continues to reference it, leading to undefined kernel behavior. The bug can corrupt memory, cause a kernel panic or result in a denial of service. The vulnerability is limited to local kernel context and would require a privileged user to trigger the device removal or hot‑plug scenario.

All Linux kernel builds that include the mt76 driver for MT7996 wireless devices and lack the recent patch that cancels pending work before freeing the crash data. The specific kernel version is not listed, but any kernel older than the commit that introduced cancel_work_sync in mt7996_unregister_device is affected.

The exploitation of this issue is local; it requires a privilege that allows triggering the device removal path. Based on the description, it is inferred that the attacker must have kernel or root access, as hot plugging or removing the wireless device typically requires such privileges. No remote network vector is indicated, and the EPSS score is reported as < 1%, suggesting a very low probability of exploitation at present. While this vulnerability could lead to a kernel crash and denial of service, it could also create an opportunity for further privilege escalation if memory corruption is exploitable in additional ways, although no such exploitation reports are currently listed in the CISA KEV catalog.