UBUNTU-CVE-2026-74325: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink() frees the offchannel mlink with plain kfree() after rcuassignpointer(NULL). However, rcuassignpointer only prevents future RCU readers from obtaining the pointer -- it does not wait for existing readers that already hold it via rcudereference. The TX datapath (e.g. mt7996macwritetxwi) dereferences mlink->wcid and mlink->idx under rcureadlock. If a TX softirq obtained the pointer via rcudereference just before the NULL assignment, it will dereference freed memory after the kfree. struct mt76viflink already contains an rcuhead field that is unused at this free site -- a developer oversight, since the adjacent kfreercumightsleep call for rxsc in the same function shows the pattern was understood. Replace kfree(mlink) with kfreercu(mlink, rcuhead).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In the Linux kernel function mt76_put_vif_phy_link(), replace kfree(mlink) with kfree_rcu(mlink, rcu_head) so the offchannel mlink is freed only after existing RCU readers complete.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using the affected Ubuntu kernel packages are exposed when the mt76 Wi-Fi driver is in use. The affected package list includes linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What conditions are required for exploitation?
An attacker needs local access and low privileges; no user interaction is required. The flaw is triggered by a race between removal of an off-channel Wi-Fi link and the transmit datapath reading that link under RCU protection.
What is the impact if the race is successfully triggered?
A transmit softirq can dereference an off-channel link after it has been freed, causing a use-after-free condition. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.
How can I tell whether a system is affected?
Check whether the system runs one of the listed Ubuntu kernel packages and uses the mt76 Wi-Fi driver. The issue specifically involves the driver's off-channel link cleanup path and transmit processing.