The Linux kernel’s mt76 driver for MT7996 Wi‑Fi devices contains a potential NULL‑pointer dereference: the routine mt76_connac_get_eht_phy_cap may return NULL, and the driver subsequently accesses the pointer without checking. This flaw can trigger a kernel panic when the driver processes certain traffic, resulting in a loss of service for the affected host. No code‑execution or privilege‑escape path is described in the supplied data.

The vulnerability resides in the mt76/mt7996 driver path within the Linux kernel. Specific kernel versions are not enumerated in the report; any build that includes the mt76 module and has not incorporated the commit that adds the NULL check is potentially exposed. All Linux distributions shipping unpatched kernels with this driver are considered affected.

The CVSS score is 5.3 and the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The likely attack vector is inferred to be traffic sent over the wireless medium that triggers the NULL dereference; an attacker with access to the wireless interface could craft such traffic. Because the flaw causes a kernel crash rather than providing code execution, the exploitation would result in denial of service. The overall risk is moderate, given the lack of persistence or data compromise and the need to reach the vulnerable driver via wireless traffic.