CVE-2026-74325
- Source
- https://cve.org/CVERecord?id=CVE-2026-74325
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74325.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-74325
- Downstream
- Published
- 2026-08-15T05:58:20.236Z
- Modified
- 2026-08-16T03:48:34.977355110Z
- Summary
- wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: use kfreercu for offchannel link in mt76putvifphy_link
mt76putvifphylink() frees the offchannel mlink with plain kfree() after rcuassignpointer(NULL). However, rcuassignpointer only prevents future RCU readers from obtaining the pointer -- it does not wait for existing readers that already hold it via rcu_dereference.
The TX datapath (e.g. mt7996macwritetxwi) dereferences mlink->wcid and mlink->idx under rcureadlock. If a TX softirq obtained the pointer via rcudereference just before the NULL assignment, it will dereference freed memory after the kfree.
struct mt76viflink already contains an rcuhead field that is unused at this free site -- a developer oversight, since the adjacent kfreercumightsleep call for rxsc in the same function shows the pattern was understood.
Replace kfree(mlink) with kfreercu(mlink, rcuhead).
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74325.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/50e700ac0edce72dee5c3a9755865d9423696ac7
- https://git.kernel.org/stable/c/7fae097aa9a56c30febf539d72ef3773165d3aa3
- https://git.kernel.org/stable/c/c7a83899203ed36696a2d35ddd03c0f522874a63
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74325.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-74325
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git