{"id":"CVE-2026-98957","kind":"vulnerability","aliases":["CVE-2026-98957"],"related":[],"title":"Linux kernel: MT7915 Wi-Fi driver crashes when unloaded with MT7916","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: disable rx napi when removing device\n\nUnloading the mt7915e module with a MT7916 triggers multiples WARN in\n__netif_napi_del_locked() and in page_pool_disable_direct_recycling()\nbecause the driver does not disable the napi before destroying it.\n\nThis is troublesome since on MT7916 it is required to unload the module\nand reinsert it with a different enable_6ghz parameter to change the\nfrequency.  The system generally becomes unstable after reinserting the\nmodule.\n\nFix it by disabling rx napi inside mt7915e itself, even through napi rx is\nenabled in the mt76 generic code.  Disabling it in the mt76 generic code\nwas previously attempted and reverted because napi was disabled too\nlate and rx handlers could access freed structures.  Note that the tx\nside is enabled and disabled by the mt76 generic code.\n\nIt is disabled in mt7915_stop_hardware() since, unlike\nmt7915_unregister_device(), is it also called in the probe path if an\nerror happens after rx napi is enabled.","summary":"The mt7915e Wi-Fi driver for MediaTek MT7916 hardware does not disable its receive NAPI polling before tearing down, which triggers kernel warnings on module unload and leaves the system unstable when the module is reloaded. The sources describe a stability problem and do not state that an attacker can run code or read data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","mediatek","mt7915e","mt7916","package","wifi"],"not_affected_if":["module-never-unloaded","no-mt7916-hardware"],"how_to_check":"- Run `uname -r` and check whether the kernel build includes the mt76 driver with `lsmod | grep mt7915e`\n- Check whether the hardware is an MT7916 card (unknown from sources; check `lspci -nn | grep -i mediatek`)","fix":"- Update the Linux kernel to a release that includes the upstream fix (fixed version unknown from sources)\n- Until updated, avoid unloading and reloading the mt7915e module on MT7916 hardware (unknown from sources for a specific workaround)","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:48+00:00","updated_at":"2026-10-25T04:57:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:57:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix (fixed version unknown from sources)\n- Until updated, avoid unloading and reloading the mt7915e module on MT7916 hardware (unknown from sources for a specific workaround)","reach":"local","title":"Linux kernel: MT7915 Wi-Fi driver crashes when unloaded with MT7916","impact":"low","summary":"The mt7915e Wi-Fi driver for MediaTek MT7916 hardware does not disable its receive NAPI polling before tearing down, which triggers kernel warnings on module unload and leaves the system unstable when the module is reloaded. The sources describe a stability problem and do not state that an attacker can run code or read data.","category":"package","nicknames":[],"who_cares":["linux","kernel","wifi","mediatek","mt7916","mt7915e"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe kernel warnings and instability, not code execution","analyst_note":"Check the upstream kernel commit and NVD entry for the fixed kernel version and whether the flaw has any security impact beyond instability.","how_to_check":"- Run `uname -r` and check whether the kernel build includes the mt76 driver with `lsmod | grep mt7915e`\n- Check whether the hardware is an MT7916 card (unknown from sources; check `lspci -nn | grep -i mediatek`)","needs_analyst":true,"not_affected_if":["no-mt7916-hardware","module-never-unloaded"],"who_is_affected":"Systems running a Linux kernel with the mt7915e driver and MediaTek MT7916 Wi-Fi hardware, most likely machines that unload and reload that module to change the enable_6ghz setting. Machines without MT7916 hardware or that never unload the module are unlikely to see the problem; the sources do not give further detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":3590,"output_tokens":691,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98957':15A,18A '6ghz':154C 'access':211C 'also':242C 'attack':75B 'attempt':198C 'becom':163C 'call':243C 'chang':157C 'code':78B,188C,195C,227C 'could':210C 'crash':8A 'cve':13A,16A 'data':81B 'del':114C 'describ':65B 'destroy':132C 'devic':100C,239C 'differ':152C 'direct':121C 'disabl':38B,95C,120C,128C,172C,189C,204C,222C,230C 'driver':7A,31B,125C 'enabl':153C,183C,220C,256C 'error':250C 'even':178C 'fi':6A,30B 'fix':169C 'follow':87C 'freed':212C 'frequenc':159C 'general':162C 'generic':187C,194C,226C 'handler':209C 'happen':251C 'hardwar':35B,234C 'insid':175C 'kernel':2A,19B,48B,85C 'late':206C 'leav':54B 'linux':1A,20B,84C 'lock':115C 'mediatek':21B,33B 'modul':51B,60B,104C,146C,168C 'mt76':93C,186C,193C,225C 'mt7915':3A,94C,232C,237C 'mt7915e':22B,27B,103C,176C 'mt7916':12A,23B,34B,107C,139C 'multipl':109C 'napi':41B,97C,113C,130C,174C,180C,202C,254C 'netif':112C 'note':214C 'packag':24B 'page':118C 'paramet':155C 'path':247C 'poll':42B 'pool':119C 'previous':197C 'probe':246C 'problem':68B 'read':80B 'receiv':40B 'recycl':122C 'reinsert':148C,166C 'reload':62B 'remov':99C 'requir':142C 'resolv':91C 'revert':200C 'run':77B 'rx':96C,173C,181C,208C,253C 'side':218C 'sinc':137C,235C 'sourc':64B 'stabil':67B 'state':72B 'stop':233C 'structur':213C 'system':56B,161C 'tear':44B 'trigger':47B,108C 'troublesom':136C 'tx':217C 'unlik':236C 'unload':10A,52B,101C,144C 'unregist':238C 'unstabl':57B,164C 'vulner':88C 'warn':49B,110C 'wi':5A,29B 'wi-fi':4A,28B 'wifi':25B,92C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mt7915e driver and MediaTek MT7916 Wi-Fi hardware, most likely machines that unload and reload that module to change the enable_6ghz setting. Machines without MT7916 hardware or that never unload the module are unlikely to see the problem; the sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98957","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}