A null pointer dereference occurs in the Linux kernel Wi‑Fi driver mt76 when the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED options are enabled and the Airoha NPU SoC is detected. The init function attempts to use a Wild Edge Driver pointer that may be null, causing a kernel oops and potentially bringing the system down. This exploit leads to loss of availability. The weakness is a classic null pointer dereference (CWE‑476).

All Linux kernel builds that include the mt76 Wi‑Fi driver with the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED configuration options enabled are affected. The specific kernel versions are not enumerated in the advisory; attackers should assume any kernel code path that triggers the init routine is vulnerable.

The vulnerability can be triggered through normal driver operation when the offending options are compiled in and the hardware is present, implying a local, non‑privileged user on the machine could provoke a crash. The CVSS score is not provided, and the EPSS metric is missing, indicating no public exploitation reports are known. The issue is not listed in the CISA KEV catalog, suggesting a low to moderate risk profile. Still, a kernel crash represents a serious denial‑of‑service vector.