In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()
Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1].
The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL.
Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized.
[14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 31, 2025 | Jul 25, 2025 |
| Suse | — | Upgrade dtb-rockchipUpgrade kernel-default-optionalUpgrade kselftests-kmp-defaultUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade dtb-mediatekUpgrade dlm-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-develUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-vdsoUpgrade dtb-nvidiaUpgrade kernel-docsUpgrade kernel-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-xilinxUpgrade kernel-rtUpgrade dtb-sprdUpgrade kselftests-kmp-rtUpgrade dtb-armUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade gfs2-kmp-rtUpgrade dtb-amazonUpgrade dtb-exynosUpgrade kernel-macrosUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade dtb-appleUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade dtb-marvellUpgrade dtb-lgUpgrade dtb-amdUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade ocfs2-kmp-64kbUpgrade kernel-symsUpgrade dtb-caviumUpgrade kernel-zfcpdumpUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-obs-qaUpgrade dtb-apmUpgrade kernel-default-livepatch-develUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade dtb-socionext | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-genericUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-virtualUpgrade linux-image-generic-64kUpgrade linux-image-gcpUpgrade linux-image-azureUpgrade linux-image-oracle-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-generic-6.14Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-awsUpgrade linux-image-generic-64k-6.14Upgrade linux-image-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-realtime-6.14 | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub