Live › vulnerability › CVE-2026-98957
Go to dashboardThe mt7915e Wi-Fi driver for MediaTek MT7916 hardware does not disable its receive NAPI polling before tearing down, which triggers kernel warnings on module unload and leaves the system unstable when the module is reloaded. The sources describe a stability problem and do not state that an attacker can run code or read data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mt7915e driver and MediaTek MT7916 Wi-Fi hardware, most likely machines that unload and reload that module to change the enable_6ghz setting. Machines without MT7916 hardware or that never unload the module are unlikely to see the problem; the sources do not give further detail.
No product ranges from the sources yet.
uname -r and check whether the kernel build includes the mt76 driver with lsmod | grep mt7915elspci -nn | grep -i mediatek)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: disable rx napi when removing device
Unloading the mt7915e module with a MT7916 triggers multiples WARN in __netif_napi_del_locked() and in page_pool_disable_direct_recycling() because the driver does not disable the napi before destroying it.
This is troublesome since on MT7916 it is required to unload the module and reinsert it with a different enable_6ghz parameter to change the frequency. The system generally becomes unstable after reinserting the module.
Fix it by disabling rx napi inside mt7915e itself, even through napi rx is enabled in the mt76 generic code. Disabling it in the mt76 generic code was previously attempted and reverted because napi was disabled too late and rx handlers could access freed structures. Note that the tx side is enabled and disabled by the mt76 generic code.
It is disabled in mt7915_stop_hardware() since, unlike mt7915_unregister_device(), is it also called in the probe path if an error happens after rx napi is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-98957")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.