---
id: CVE-2026-74325
title: 'wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

  mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree()
  after rcu_assign_pointer(N…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f <
    c7a83899203ed36696a2d35ddd03c0f522874a63
  - >-
    Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f <
    50e700ac0edce72dee5c3a9755865d9423696ac7
  - >-
    Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f <
    7fae097aa9a56c30febf539d72ef3773165d3aa3
  - Linux 6.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:53:28.772438Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:33.235Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74325'
references:
  - url: 'https://git.kernel.org/stable/c/c7a83899203ed36696a2d35ddd03c0f522874a63'
  - url: 'https://git.kernel.org/stable/c/50e700ac0edce72dee5c3a9755865d9423696ac7'
  - url: 'https://git.kernel.org/stable/c/7fae097aa9a56c30febf539d72ef3773165d3aa3'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06317
ingestedAt: '2026-10-16T19:46:24.378Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree()
after rcu_assign_pointer(NULL). However, rcu_assign_pointer only prevents
future RCU readers from obtaining the pointer -- it does not wait for
existing readers that already hold it via rcu_dereference.

The TX datapath (e.g. mt7996_mac_write_txwi) dereferences mlink->wcid
and mlink->idx under rcu_read_lock. If a TX softirq obtained the pointer
via rcu_dereference just before the NULL assignment, it will dereference
freed memory after the kfree.

struct mt76_vif_link already contains an rcu_head field that is unused at
this free site -- a developer oversight, since the adjacent
kfree_rcu_mightsleep call for rx_sc in the same function shows the
pattern was understood.

Replace kfree(mlink) with kfree_rcu(mlink, rcu_head).

## Affected

- `Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < c7a83899203ed36696a2d35ddd03c0f522874a63`
- `Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 50e700ac0edce72dee5c3a9755865d9423696ac7`
- `Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 7fae097aa9a56c30febf539d72ef3773165d3aa3`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.