CVE-2026-98957 - Vulnerability Details

- wifi: mt76: mt7915: disable rx napi when removing device

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: disable rx napi when removing device

Unloading the mt7915e module with a MT7916 triggers multiples WARN in
__netif_napi_del_locked() and in page_pool_disable_direct_recycling()
because the driver does not disable the napi before destroying it.

This is troublesome since on MT7916 it is required to unload the module
and reinsert it with a different enable_6ghz parameter to change the
frequency. The system generally becomes unstable after reinserting the
module.

Fix it by disabling rx napi inside mt7915e itself, even through napi rx is
enabled in the mt76 generic code. Disabling it in the mt76 generic code
was previously attempted and reverted because napi was disabled too
late and rx handlers could access freed structures. Note that the tx
side is enabled and disabled by the mt76 generic code.

It is disabled in mt7915_stop_hardware() since, unlike
mt7915_unregister_device(), is it also called in the probe path if an
error happens after rx napi is enabled.

Published: 2026-10-23

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The driver for the mt7915 Wi‑Fi device fails to disable the receive NAPI poll before the hardware is destroyed. When the module is unloaded, the kernel reports multiple warnings and the system becomes unstable after reinsertion because NAPI handlers may still access freed resources. This weakness can cause a kernel panic or other form of system instability if the driver is removed or reloaded under normal operation.

Affected Systems

Linux kernel, specifically the mt76/mt7915 Wi‑Fi driver stack used on MT7916 hardware. The issue arises when the mt7915e module is unloaded and the device is hot‑unplugged or reconfigured for a different frequency.

Risk and Exploitability

CVSS score 4.4, EPSS score <1%, KEV: not listed. The attack vector is local: any user or process with the ability to unload or reload the Wi‑Fi kernel module can trigger the instability. Because the kernel may crash, the potential impact is high for availability, though confidentiality and integrity are not directly affected.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e57b7901469fc0b021930b83a8094baaf3d81b09`	affected	< 0281dac1e213329b053fb02e612de7f1477a52d7
`e57b7901469fc0b021930b83a8094baaf3d81b09`	affected	< 0f9afe238eeb79829f0f92f376ba3a20781caccd
`e57b7901469fc0b021930b83a8094baaf3d81b09`	affected	< 7199ee4b47de0b61fa6455a1587c5ab645ebe262
`e57b7901469fc0b021930b83a8094baaf3d81b09`	affected	< 916c484d29d82f45c281da2786fcd6a1284430ce

Linux

affected

Version	Status	Constraints
`5.8`	affected	—
`0`	unaffected	< 5.8
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[e57b7901469fc0b021930b83a8094baaf3d81b09,0281dac1e213329b053fb02e612de7f1477a52d7)`	affected	code_commit	—
`[e57b7901469fc0b021930b83a8094baaf3d81b09,0f9afe238eeb79829f0f92f376ba3a20781caccd)`	affected	code_commit	—
`[e57b7901469fc0b021930b83a8094baaf3d81b09,7199ee4b47de0b61fa6455a1587c5ab645ebe262)`	affected	code_commit	—
`[e57b7901469fc0b021930b83a8094baaf3d81b09,916c484d29d82f45c281da2786fcd6a1284430ce)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`5.8`	affected	generic	—
`[0,5.8)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[e57b7901469fc0b021930b83a8094baaf3d81b09,0281dac1e213329b053fb02e612de7f1477a52d7)`	affected	code_commit	—
`[e57b7901469fc0b021930b83a8094baaf3d81b09,0f9afe238eeb79829f0f92f376ba3a20781caccd)`	affected	code_commit	—
`[e57b7901469fc0b021930b83a8094baaf3d81b09,7199ee4b47de0b61fa6455a1587c5ab645ebe262)`	affected	code_commit	—
`[e57b7901469fc0b021930b83a8094baaf3d81b09,916c484d29d82f45c281da2786fcd6a1284430ce)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.8`	affected	generic	—
`[0,5.8)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official kernel patch that disables receive NAPI in mt7915e during stop and error handling paths
Upgrade the system to a kernel release that includes this fix, or backport the patch to the running kernel
Avoid unloading and reloading the mt7915e driver unless a hardware parameter change is required; if possible, use interface configuration tools that do not require module removal

Generated by OpenCVE AI on October 29, 2026 at 20:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98957.mbox
https://git.kernel.org/stable/c/0281dac1e213329b053fb02e612de7f1477a52d7
https://git.kernel.org/stable/c/0f9afe238eeb79829f0f92f376ba3a20781caccd
https://git.kernel.org/stable/c/7199ee4b47de0b61fa6455a1587c5ab645ebe262
https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce
https://nvd.nist.gov/vuln/detail/CVE-2026-98957
https://www.cve.org/CVERecord?id=CVE-2026-98957

History

Thu, 29 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-773

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-459
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98957.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98957 https://www.cve.org/CVERecord?id=CVE-2026-98957
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-773

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in __netif_napi_del_locked() and in page_pool_disable_direct_recycling() because the driver does not disable the napi before destroying it. This is troublesome since on MT7916 it is required to unload the module and reinsert it with a different enable_6ghz parameter to change the frequency. The system generally becomes unstable after reinserting the module. Fix it by disabling rx napi inside mt7915e itself, even through napi rx is enabled in the mt76 generic code. Disabling it in the mt76 generic code was previously attempted and reverted because napi was disabled too late and rx handlers could access freed structures. Note that the tx side is enabled and disabled by the mt76 generic code. It is disabled in mt7915_stop_hardware() since, unlike mt7915_unregister_device(), is it also called in the probe path if an error happens after rx napi is enabled.
Title		wifi: mt76: mt7915: disable rx napi when removing device
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0281dac1e213329b053fb02e612de7f1477a52d7 https://git.kernel.org/stable/c/0f9afe238eeb79829f0f92f376ba3a20781caccd https://git.kernel.org/stable/c/7199ee4b47de0b61fa6455a1587c5ab645ebe262 https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:19:22.400Z

Updated: 2026-10-23T12:19:22.400Z

Reserved: 2026-09-25T10:25:14.382Z

Link: CVE-2026-98957

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:17.007

Modified: 2026-10-23T13:17:17.007

Link: CVE-2026-98957

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98957 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T20:15:14Z

Weaknesses

CWE-459
Incomplete Cleanup

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object