The mt7996 Wi‑Fi driver leaks transmission tokens when a MT76 link configuration or station lookup fails within the mt7996_tx_prepare_skb routine. Because each lookup failure consumes a token that is never returned, repeated failures can exhaust the limited token pool, causing subsequent packets to be blocked and resulting in a denial of service or degraded throughput. The flaw is a classic resource management defect characterized by an uncontrolled reuse of a scarce resource.

The flaw exists in the Linux kernel’s mt76 WLAN driver, specifically the mt7996 module. All kernel builds that incorporate this driver before the commit referenced in the fix are affected. The patch resides in the upstream kernel source and applies to any kernel version that includes the driver component at the time of update.

The EPSS score is reported as below 1 percent, indicating a very low exploitation probability at this time, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 8.8. Based on the description, it is inferred that an attacker who can trigger repeated lookup failures—such as by connecting to the Wi‑Fi interface with malformed or failing association attempts—could force the driver to leak tokens continuously. Over time this could exhaust the limited token pool and disconnect legitimate traffic, producing a denial of service. No explicit prerequisites or privilege levels are stated in the CVE text, so the feasibility of such an exploit depends on the attacker’s ability to induce the failure conditions.