A null pointer dereference occurs in the mt76 mt7996 wifi driver when mt76_connac_get_he_phy_cap may return NULL and the code fails to check this before accessing the pointer. If the function returns NULL, the kernel will dereference a NULL pointer, leading to a crash or kernel panic. This results in a loss of system availability for the affected node. The weakness is a classic NULL pointer dereference and is mapped to CWE-476.

The vulnerability affects Linux kernel systems that include the mt76 driver for mt7996 hardware. All Linux kernel builds prior to the introduction of the safety check in the referenced commit are potentially impacted; the vendor product list indicates generic Linux kernel distributions.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.9. Based on the description, the likely attack vector is local or requires control over the Wi‑Fi device: an attacker could craft traffic or manipulate the device to trigger the driver path that invokes mt76_connac_get_he_phy_cap and cause a NULL pointer use. The resulting kernel crash would lead to a denial of service. The risk is high if the system is exposed to untrusted network traffic and no mitigations are applied, but it does not appear to be exploitable remotely without additional conditions.