[PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

Eason Lai (賴易聖) Eason.Lai at mediatek.com
Mon Oct 12 23:07:19 PDT 2026


On Mon, 2026-10-12 at 21:18 -0700, Devin Wittmayer wrote:
> 
> A heads-up, since this one is on me: my d12a54be2604 in mt76 changed
> the line this patch replaces, so it won't apply there or on
> wireless-next as is. That commit makes the reset return early if the
> driver can't take ownership back. If you want to keep that, it would
> look something like:
> 
>         err = __mt792xe_mcu_drv_pmctrl(dev);
>         if (err)
>                 return err;
> 
>         clear_bit(MT76_STATE_PM, &mphy->state);
> 
> Devin

Hi Devin,

Thanks for the heads-up.
v2 will be rebased and incorporate your suggested change. 

Thanks,
Eason


More information about the Linux-mediatek mailing list