At the heart of the issue is a NULL pointer dereference in the mt76 mt7925 wireless driver’s reset logic. During a reset recovery sequence, the driver iterates over links that may no longer be valid, causing a NULL bss configuration to be passed to firmware handling code. This produces a kernel crash, bringing the entire system offline and thereby denying service. The vulnerability is a classic NULL pointer dereference (CWE‑476) and is limited to a crash scenario without direct remote code execution.

All installations of the Linux kernel that include the mt76 driver and the mt7925 module before the patch commit are affected. This encompasses any distribution where the kernel contains the buggy reset logic, regardless of vendor. The flaw does not target a specific distribution or vendor; it simply affects every unpatched instance of the driver.

The CVSS score of 4.8 classifies the vulnerability as moderate in severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves triggering a reset scenario—such as an MLO link change or an MCU timeout recovery—typically via crafted network traffic or internal fault conditions. This inferred vector would lead to a kernel crash. No public exploitation has been documented, and the impact remains a local denial of service unless an attacker can leverage the crash for further privilege escalation.