The kernel wifi driver mt76 suffered an omission of a critical wcid publish check when adding a WLAN client ID (wcid). Without this check, the driver reinitializes wcid->poll_list, corrupting the poll list. The corruption appears as a list_add error where a node’s previous pointer points to itself, which can lead to kernel memory corruption. This flaw is a concurrent write (CWE-662) that can cause kernel instability, crashes, and, if repeatedly triggered, a denial of service for the device owning the driver.

All Linux kernels that incorporate the mt76 wireless driver with the mt7925 MAC implementation are affected. The issue was observed in kernel 7.1-rc4 and earlier builds before the patch that adds the wcid publish check in mt76_sta_add. Devices running those kernel versions with enabled Wi‑Fi interfaces that use the mt7925 chipset are susceptible.

The CVSS score of 8.8 marks this as a high‑severity vulnerability, while the EPSS score of < 1 % indicates a low current exploitation probability. The flaw is not listed in CISA's KEV catalog, yet it could be exploited remotely over the wireless interface: an attacker who can send crafted authentication frames to a target device may trigger the corruption. If successful, the kernel crash or memory corruption could lead to denial of service. Based on the description, the likely attack vector is remote via malicious Wi‑Fi traffic; this is inferred because the CVE data does not explicitly state the vector.