In the mt76 WiFi driver for the MT7925 chipset, an outstanding mlo_pm_work item can continue to run after the device is reset, suspended, or unregistered. The work may then access vif/bss data that has already been freed or send MCU commands while the firmware is not available, leading to a use‑after‑free that can corrupt kernel memory or cause a system crash. The fix adds cancel_delayed_work_sync(&dev->mlo_pm_work) the work before the device state becomes invalid. Based on the description, this flaw would only be exploitable by an attacker that can trigger such a reset, suspend, or unregister event.

All builds of the Linux kernel that include the mt76 WiFi driver for the MT7925 chipset are vulnerable. This applies to any kernel versions released before the patch that added cancel_delayed_work_sync calls in the reset, unregister, and suspend paths for PCIe and USB interfaces of the MT7925. No specific version range is documented, so any kernel lacking the recent commit that implements the cancellation logic is considered affected.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The attack would require local access to trigger a device reset, suspend, or unregister to execute the device teardown paths. Thus, while the risk is significant, a local attacker could potentially induce a system crash or kernel memory corruption.