The Linux kernel wifi driver mt76 suffered a missing check when adding a WLAN client ID (wcid), causing reinitialization of wcid->poll_list and leading to corruption of the poll list. The corruption manifested as a list_add error where a node’s previous pointer was set to point to itself, which could corrupt kernel memory. This flaw can cause kernel instability, crashes, or if an attacker can repeatedly trigger it, potentially lead to denial of service since the affected code runs in privileged kernel context.

All Linux kernels that incorporate the mt76 wireless driver with the mt7925 MAC implementation are affected. The issue was observed in kernel 7.1-rc4 and earlier builds before the patch that adds the wcid publish check in mt76_sta_add. Devices running those kernel versions with enabled Wi-Fi interfaces that use the mt7925 chipset are susceptible.

The CVSS score of 8.8 marks this as a high-severity vulnerability, while the EPSS score of < 1 % indicates a low current exploitation probability. The flaw is not listed in CISA's KEV catalog, yet it could be exploited remotely over the wireless interface: an attacker who can send crafted authentication frames to a target device may trigger the corruption. If successful, the kernel crash or memory corruption could lead to denial of service. Based on the description, the likely attack vector is remote via malicious Wi-Fi traffic; this is inferred because the CVE data does not explicitly state the vector.