In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()
Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1].
The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL.
Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized.
[14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 31, 2025 | Jul 25, 2025 |
| Suse | — | Upgrade dtb-sprdUpgrade kernel-docsUpgrade cluster-md-kmp-rtUpgrade dtb-nvidiaUpgrade dlm-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-defaultUpgrade kernel-rt-develUpgrade cluster-md-kmp-defaultUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade kselftests-kmp-rtUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade dtb-amazonUpgrade kernel-symsUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade dtb-caviumUpgrade dtb-appleUpgrade gfs2-kmp-rtUpgrade dtb-marvellUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade dlm-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade dtb-apmUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade ocfs2-kmp-rtUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade dtb-socionextUpgrade kernel-64kbUpgrade dtb-freescaleUpgrade dtb-amdUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade ocfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-exynos | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1016-oemUpgrade linux-image-realtimeUpgrade linux-image-azure-6.14Upgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-oracle-64kUpgrade linux-image-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-virtualUpgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-gcp-6.14Upgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1018-raspi | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub