In the Linux kernel’s mt76 driver for the mt7996 chipset, if the primary PCIe function fails to attach a WED device, the probe path may still proceed to attach the WED for the secondary function. This results in a half‑configured device that later crashes. The secondary attach also inadvertently re‑enables hwrro_mode, reversing protection that the primary failure had disabled, further destabilizing the hardware and software stack.

All Linux distributions that ship the mt76 driver containing an mt7996 implementation are affected. Since no specific kernel versions are listed, any kernel that includes this code path should be considered potentially impacted.

Based on the description, it is inferred that the vulnerability can be exploited by an attacker with local or privileged access who can trigger the driver’s probe path. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of current exploitation. The absence of a CVSS score limits a precise severity assessment, but the EPSS data and the potential for a device crash suggest a significant denial‑of‑service risk.