A null pointer dereference occurs in the mt7925 Wi‑Fi driver when the subsystem processes a decap offload request for a multi‑link station. The driver assumes every link in the valid‑links mask belongs to the station and dereferences the link structure without verifying that it is non‑NULL. If the link does not belong to the station, the code writes a flag field via a NULL pointer, causing a kernel panic. The resulting loss of kernel availability manifests as a device reboot or service disruption, with no direct impact on confidentiality or integrity.

The flaw affects the Linux kernel’s mt76 Wi‑Fi subsystem when the mt7925 driver is present. Any Linux system incorporating this driver, regardless of specific kernel release, is potentially vulnerable. No version or patch level is specified, so all builds that include mt7925 remain at risk until the patch is applied.

The CVSS score of 5.5 reflects a moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalogue. The defect is triggered by the handling of Wi‑Fi frames, so a malicious or malformed packet that includes a decap offload command would likely be required. Based on the description, it is inferred that the likely attack vector is an attacker sending specially crafted Wi‑Fi traffic that reaches the device. If such traffic can reach the device, an attacker could remotely induce a kernel crash, resulting in a denial‑of‑service condition. With no known public exploit, the risk is considered moderate to high, warranting immediate attention.