In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL in mtk_wed_setup_tc_block_cb().
---------- Unable to handle kernel paging request at virtual address 0072460bca32b4f5 Call trace: mtk_wed_setup_tc_block_cb+0x4/0x38 0xffffffc0794084bc tcf_block_playback_offloads+0x70/0x1e8 tcf_block_unbind+0x6c/0xc8 ... ---------
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-rt-livepatch-develUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade dtb-qcomUpgrade dtb-apmUpgrade dtb-exynosUpgrade dlm-kmp-azureUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-rtUpgrade dtb-amlogicUpgrade dtb-hisiliconUpgrade kernel-macrosUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-marvellUpgrade dtb-mediatekUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-symsUpgrade kernel-64kbUpgrade kernel-debug-livepatch-develUpgrade dtb-armUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade kernel-devel-azureUpgrade kernel-devel-rtUpgrade dtb-freescaleUpgrade kernel-syms-rtUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kselftests-kmp-defaultUpgrade dtb-lgUpgrade kernel-rtUpgrade kernel-default-develUpgrade kernel-docsUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade kernel-rt-vdsoUpgrade dtb-renesasUpgrade dtb-sprdUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade gfs2-kmp-defaultUpgrade dtb-appleUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade dtb-allwinnerUpgrade kernel-azure-optionalUpgrade kernel-azureUpgrade dtb-nvidiaUpgrade dlm-kmp-rtUpgrade kernel-debugUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade dtb-amdUpgrade kernel-develUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-caviumUpgrade dtb-xilinxUpgrade kernel-rt-extraUpgrade kernel-debug-develUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-azureUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-64kb-extraUpgrade dtb-alteraUpgrade kernel-source-rt | Dec 5, 2025 | Oct 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub