In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()
Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1].
The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL.
Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized.
[14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 31, 2025 | Jul 25, 2025 |
| Suse | — | Upgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade cluster-md-kmp-rtUpgrade dtb-rockchipUpgrade kernel-rt-livepatchUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade cluster-md-kmp-defaultUpgrade dtb-sprdUpgrade dtb-qcomUpgrade kernel-docsUpgrade gfs2-kmp-defaultUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-rt-extraUpgrade kernel-rtUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade kernel-rt-vdsoUpgrade kernel-64kb-extraUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dtb-renesasUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-develUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-zfcpdumpUpgrade kernel-rt-optionalUpgrade dlm-kmp-64kbUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade kernel-sourceUpgrade dtb-socionextUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade dtb-lgUpgrade dtb-caviumUpgrade dtb-appleUpgrade dtb-amdUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade dtb-marvellUpgrade dtb-exynosUpgrade dtb-amazon | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-aws-6.14Upgrade linux-image-genericUpgrade linux-image-oem-24.04Upgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-generic-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-aws-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-raspi-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-azure-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-oracleUpgrade linux-image-realtime-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-aws | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub