The vulnerability is a NULL pointer dereference in the mt76 Wi‑Fi driver for the MT7925 chipset. The routine mt76_connac_get_he_phy_cap can return NULL, but the code in mt7925_mcu_bss_he_tlv() does not check the pointer before use, which can cause a kernel panic. This results in a loss of system availability and potentially disrupts all services running on the affected device because the kernel is forced to reboot. The weakness is a classic NULL pointer dereference (CWE‑476).

All Linux kernel instances that include the mt76 driver for devices using the MT7925 chipset and that have not yet applied the patch referenced in the provided commit URLs are affected. The specific kernel versions are not listed, but any distribution maintainer who has not incorporated the fix into the base kernel should apply the update.

The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the kernel‑level nature of the flaw means that a local user or an attacker who can affect the Wi‑Fi subsystem could trigger a crash, so the severity is moderate, with a CVSS score of 5.5. Based on the description, it is inferred that the attacker would need direct local access or the ability to cause the driver to process malformed data from the hardware interface, which is less likely to be exposed remotely.