LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26892: wifi: mt76: mt7921e: fix use-after-free in free_irq()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For this case, let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access anymore. BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e] Read of size 8 at addr ffff88824a7d3b78 by task rmmod/11115 CPU: 28 PID: 11115 Comm: rmmod Tainted: G W L 5.17.0 #10 Hardware name: Micro-Star International Co., Ltd. MS-7D73/MPG B650I EDGE WIFI (MS-7D73), BIOS 1.81 01/05/2024 Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x1f/0x190 ? mt7921_irq_handler+0xd8/0x100 [mt7921e] ? mt7921_irq_handler+0xd8/0x100 [mt7921e] kasan_report.cold+0x7f/0x11b ? mt7921_irq_handler+0xd8/0x100 [mt7921e] mt7921_irq_handler+0xd8/0x100 [mt7921e] free_irq+0x627/0xaa0 devm_free_irq+0x94/0xd0 ? devm_request_any_context_irq+0x160/0x160 ? kobject_put+0x18d/0x4a0 mt7921_pci_remove+0x153/0x190 [mt7921e] pci_device_remove+0xa2/0x1d0 __device_release_driver+0x346/0x6e0 driver_detach+0x1ef/0x2c0 bus_remove_driver+0xe7/0x2d0 ? __check_object_size+0x57/0x310 pci_unregister_driver+0x26/0x250 __do_sys_delete_module+0x307/0x510 ? free_module+0x6a0/0x6a0 ? fpregs_assert_state_consistent+0x4b/0xb0 ? rcu_read_lock_sched_held+0x10/0x70 ? syscall_enter_from_user_mode+0x20/0x70 ? trace_hardirqs_on+0x1c/0x130 do_syscall_64+0x5c/0x80 ? trace_hardirqs_on_prepare+0x72/0x160 ? do_syscall_64+0x68/0x80 ? trace_hardirqs_on_prepare+0x72/0x160 entry_SYSCALL_64_after_hwframe+0x44/0xae

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver bug in the MediaTek MT7921E Wi-Fi PCIe driver. During device or module removal, the interrupt handler could access already-freed memory. The business risk is most relevant to Linux laptops, workstations, or appliances using that Wi-Fi chipset, where the issue could cause instability or undefined kernel behavior.

Executive priority

Treat as a targeted kernel maintenance item for Linux endpoint fleets using MediaTek Wi-Fi. It does not warrant emergency response without matching hardware, affected kernels, or operational instability evidence.

Technical view

The mt76 mt7921e driver had a use-after-free path in free_irq() after IRQ deregistration. The fix marks the device removed with MT76_REMOVED so the shared IRQ handler stops accessing resources after teardown. The source bundle includes KASAN evidence during rmmod and stable kernel fix commits.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the mt7921e driver and compatible MediaTek MT7921E PCIe Wi-Fi hardware. Cloud servers and systems without this driver or hardware are less likely exposed.

Exploitation context

The provided sources do not show active exploitation, public exploit code, or CISA KEV listing. The observed trigger is module or device removal involving shared IRQ cleanup, not a documented remote attack path.

Researcher notes

Evidence is strong for the bug class and fix path, but incomplete for impact severity. No CVSS, CWE, exploitability analysis, or distribution-specific fixed package data is included in the provided bundle.

Mitigation direction

  • Identify Linux systems using the mt7921e driver and MT7921E Wi-Fi hardware.
  • Prioritize kernel updates containing the referenced stable fixes.
  • Check distribution vendor advisories for backported kernel packages.
  • Avoid unnecessary driver unload or device removal on exposed systems until patched.

Validation and detection

  • Inventory loaded kernel modules for mt7921e on Linux endpoints.
  • Map running kernel versions against vendor fixed kernel builds.
  • Confirm installed kernel includes one of the referenced stable commits or vendor backport.
  • Review kernel logs for KASAN or crash reports involving mt7921_irq_handler.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26892 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9270270d62191b7549296721e8d5f3dc0df01563, 9270270d62191b7549296721e8d5f3dc0df01563, 9270270d62191b7549296721e8d5f3dc0df01563, 9270270d62191b7549296721e8d5f3dc0df01563, a76eaaaafd8b408238d7865bbbbd311f08988f3d, 95e41ac30a0d0b3637f0b3c93235a7a107a2fb7f, 6.2.15, 6.3.2unaffected
LinuxLinux6.4, 0, 6.6.23, 6.7.11, 6.8.2, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.