A null pointer dereference is triggered in the Linux kernel Wi‑Fi driver mt76 when the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED options are compiled in and an Airoha NPU SoC is detected. During the init routine mt7996_init_tx_queues(), the driver uses a NULL WED pointer without validating it, causing a kernel panic and rendering the system unavailable until a reboot.

All Linux kernel builds that include the mt76 Wi‑Fi driver with the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED configuration options enabled are affected. The specific kernel versions are not enumerated in the advisory; users should assume any kernel code path that triggers the init routine while the settings are compiled in is vulnerable.

Based on the description, it is inferred that the vulnerability can only be exploited when the system is running the mt76 Wi‑Fi driver with the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED options compiled in and an Airoha NPU SoC is present. In this scenario, the driver will attempt to initialise transmit queues and dereference a NULL WED pointer, resulting in a kernel panic. Because the fault occurs during normal driver operation, an attacker with local access could trigger it by causing the driver initialisation routine to run or by forcing the wireless interface to reset. The CVSS score of 5.5 indicates a medium severity impact on availability, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, and no public exploits are known.