The flaw exists in the Linux kernel's mt76 Wi‑Fi driver for MT7925 devices. The code that prepares a transmit packet assumes that sufficient headroom is already available for a TX descriptor and a USB header. Local traffic does reserve the required space, but frames forwarded through the bridge do not, causing a buffer overrun when skb_push() is called. This triggers a kernel BUG and a panic, rendering the host unresponsive. The problem manifests when a wired interface is bridged to an MT7925‑based access point and the first forwarded frame triggers the overflow. The impact is a local or network‑initiated denial of service; there is no evidence of an arbitrary code execution vector.

Affected systems include Linux kernel implementations that use the mt76 Wi‑Fi driver for MT7925 hardware. The issue was reproduced on a Raspberry Pi 5 running a recent kernel and on an MT7986 router running OpenWrt. Any distribution that ships the mt7925 driver without the headroom guard is vulnerable.

No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating low publicly documented exploitation activity. The CVSS score is not provided but the severity can be inferred as high because a single benign packet can crash the kernel. The attack vector is local or remote depending on whether an attacker can inject traffic through a bridged interface. The condition for exploitation is that forwarded frames lose the required headroom in their skb, which occurs when the ingress network device does not reserve extra space. The risk is that any user with network access to the device can trigger a crash, leading to a denial of service.