The Linux kernel’s mt76 driver for the MT7996 chipset contains a memory‑management flaw in the mt7996_mac_sta_deinit_link() routine. During station link teardown the driver clears a WCID pointer without properly handling its state, creating a susceptible use‑after‑free condition. This is a classic instance of CWE‑825 and can lead to kernel memory corruption. If an attacker can trigger the deinitialization of a station they control, the corrupted pointer could destabilise the kernel, potentially causing a denial of service or, in extreme cases, undermining kernel integrity.

All Linux kernel installations that load the mt76 module and employ the MT7996 wireless hardware are affected. No specific kernel release is delineated in the public data, so any kernel build containing the unpatched mt76 driver is at risk. The affected vendor is the Linux kernel project itself.

The CVSS base score of 8.8 classifies the issue as high severity. EPSS indicates a low likelihood of exploitation with a score below 1%, and the vulnerability has not been reported in the CISA KEV catalog. The most likely attack vector is local, inferred from the driver’s need to handle station deinitialization events; it requires an attacker with the ability to influence Wi‑Fi station activity. While remote exploitation cannot be ruled out entirely, the primary risk remains elevated, warranting timely mitigation.