The vulnerability involves a NULL pointer dereference in the mt7996_mac_write_txwi_80211 routine of the mt76 WiFi driver. When a packet with an injected radiotap header is processed, the function can receive a NULL vif pointer and proceed to call ieee80211_vif_is_mld without checking for null, causing a kernel crash. Such a crash results in a system reboot or loss of network services, representing a denial of service.

Linux kernel versions that include the mt76 driver targeting the MediaTek MT7996 wireless chip are affected. Prior to the patch, devices running those kernel versions could be brought down by an attacker crafting malformed frames. The commit database links highlight that the fix was merged into the mainstream kernel, but no specific kernel version numbers are listed in the data. Administrators should verify that their kernel and mt76 driver contain the changes in the cited git commits.

Based on the description, it is inferred that the attack vector is local over the air. The CVSS score is 5.5, indicating a moderate impact. The EPSS score is < 1% and the vulnerability is not listed in KEV, suggesting limited public exploitation. The fault could be triggered by any wireless client that can transmit crafted frames. Because a kernel panic would terminate all processes, the seriousness is high, but the low exploitation probability reduces urgency slightly; nevertheless, updating the kernel promptly remains the advised action.