A null pointer dereference occurs when the mt7925 driver receives a TXRX_NOTIFY event that is valid only for mmio buses but is dispatched on USB or other non‑mmio buses. The driver then calls a NULL queue_ops->tx_cleanup() callback, leading to a kernel BUG and crash. This flaw allows a local attacker to trigger a kernel panic, effectively denying service to the affected system. The weakness falls under CWE‑476, Unchecked Null Pointer Dereference.

The vulnerability is present in the Linux kernel’s mt76 driver for the mt7925 wireless chipset, affecting both mmio and non‑mmio (e.g., USB) bus configurations. Impacted systems are any Linux installations that load the mt7925 module or use the associated wireless interface; no specific kernel or module versions are enumerated in the data.

The EPSS score is not supplied, and the issue is not listed in the CISA KEV catalog, indicating low publicly documented exploitation. However, the kernel panic can be triggered with local access if the malicious driver or USB device is activated, making the risk medium to high for exposed machines. No remote code execution is possible; the flaw can only cause a denial of service.