Deren Wu

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a use-after-free vulnerability in the `free irq()` function of the MediaTek MT7925E (PCIe) driver in the Linux kernel. This vulnerability can be exploited to cause a denial of service. The `mt7925 pci remove()` function in the `drivers/net/wireless/mediatek/mt76/mt7925/pci.c` module is also affected by the reuse of previously freed memory. To address this issue, a flag `MT76 REMOVED` is applied to indicate that the device was removed, preventing further resource access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a crash in the chip reset fail in the mt7921e component of the Linux kernel. When the driver own fails in reset, running mac reset several times can trigger a system crash. This happens because the process keeps waiting for a state change in napi diable() after disabling "tx napi" without re-enabling or scheduling it again. To avoid this problem, the solution involves going to final resource handling if the driver own fails. The vulnerability can be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been identified, specifically in the mt76 and mt7921s drivers. The issue arises when the mt7921s driver receives frames with fragment buffers in monitor mode. If a CTS packet is received, the payload is only 10 bytes, and 6 bytes of header padding are required after the RXD buffer. However, if the buffer size is pulled with skb pull(), it may trigger a BUG ON(skb->len < skb->data len) error in skb pull(). To resolve this, the RXD size has been enlarged from 128 to 256 bytes to ensure all MCU operations occur within the linear buffer. **Recommendations** To resolve this issue, update the Linux kernel to a version that includes the fix for the mt76 and mt7921s drivers, which enlarges the RXD size from 128 to 256 bytes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.