CVE-2026-74325High· 7.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree() after rcu_assign_pointer(N…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 15, 2026

Updated

Oct 16, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.17% · p7

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 62 days

Aug 15, 2026Published
Disclosed via NVD
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.2%

Linux #nvd #cve.org

Affected

Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < c7a83899203ed36696a2d35ddd03c0f522874a63
Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 50e700ac0edce72dee5c3a9755865d9423696ac7
Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 7fae097aa9a56c30febf539d72ef3773165d3aa3
Linux 6.14

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree() after rcu_assign_pointer(NULL). However, rcu_assign_pointer only prevents future RCU readers from obtaining the pointer -- it does not wait for existing readers that already hold it via rcu_dereference.

The TX datapath (e.g. mt7996_mac_write_txwi) dereferences mlink->wcid and mlink->idx under rcu_read_lock. If a TX softirq obtained the pointer via rcu_dereference just before the NULL assignment, it will dereference freed memory after the kfree.

struct mt76_vif_link already contains an rcu_head field that is unused at this free site -- a developer oversight, since the adjacent kfree_rcu_mightsleep call for rx_sc in the same function shows the pattern was understood.

Replace kfree(mlink) with kfree_rcu(mlink, rcu_head).

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org