The vulnerability originates from a race condition in the mt76 driver for MT7603 devices that causes an uninitialized global station WCID to be published. When a frame is injected through a monitor interface, the driver queues the frame on the WCID’s tx_pending or tx_offchannel queue, leading to a call to __skb_queue_tail() where a NULL prev pointer is dereferenced. This results in a kernel oops and a system crash, effectively denying service of the affected node. The flaw does not provide a direct path to arbitrary code execution, but the crash can be leveraged to disrupt network connectivity and potentially trigger privilege escalation if the system is configured to restart automatically.

All Linux kernel distributions that ship the mt76 driver before the inclusion of commit 0335c034e726 are affected. The issue is present on any system using MT7603 wireless adapters, which are common in consumer Wi‑Fi dongles and embedded networking devices. Any Linux installation that supports monitor mode on such adapters may be vulnerable until a kernel update or driver patch is applied.

The Advisory does not provide a CVSS or EPSS score, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the injection of raw frames through a monitor interface, which requires wireless access to the victim system or a compromised device that can generate monitor traffic. While the flaw leads to a denial of service via a kernel panic, it could be considered a high‑severity risk if the compromised system is critical. Administrators should treat the absence of formal scoring as insufficient data, but the potential for system disruption warrants proactive mitigation. The race condition and resulting null pointer dereference could be exploited by anyone able to send malicious frames, making the threat practical in unprotected environments.