Deren Wu

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a use-after-free vulnerability in the `free irq()` function of the MediaTek MT7925E (PCIe) driver in the Linux kernel. This vulnerability can be exploited to cause a denial of service. The `mt7925 pci remove()` function in the `drivers/net/wireless/mediatek/mt76/mt7925/pci.c` module is also affected by the reuse of previously freed memory. To address this issue, a flag `MT76 REMOVED` is applied to indicate that the device was removed, preventing further resource access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a crash in the chip reset fail in the mt7921e component of the Linux kernel. When the driver own fails in reset, running mac reset several times can trigger a system crash. This happens because the process keeps waiting for a state change in napi diable() after disabling "tx napi" without re-enabling or scheduling it again. To avoid this problem, the solution involves going to final resource handling if the driver own fails. The vulnerability can be exploited to cause a denial of service.

A buffer overflow issue exists in the ` skb pull()` function within the `include/linux/skbuff.h` module. In the mt7921s driver, when operating in monitor mode, the system may receive CTS packets with a 10-byte payload requiring 6 bytes of header padding after the RXD buffer. If the RXD is only in the first linear buffer and `skb pull()` is used to pull the buffer size `RXD-size+6` bytes, it triggers a kernel BUG. This occurs because the operation may attempt to access a non-linear buffer, leading to a system crash and denial of service.