In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()
Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1].
The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL.
Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized.
[14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 31, 2025 | Jul 25, 2025 |
| Suse | — | Upgrade kernel-default-vdsoUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade dtb-sprdUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade kernel-default-optionalUpgrade dtb-rockchipUpgrade dtb-xilinxUpgrade kernel-rtUpgrade kernel-develUpgrade dtb-qcomUpgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-rt-extraUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-defaultUpgrade kernel-docsUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade kernel-64kbUpgrade dtb-socionextUpgrade kernel-sourceUpgrade gfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-64kb-optionalUpgrade dtb-renesasUpgrade dtb-exynosUpgrade dtb-amazonUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade dtb-hisiliconUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade ocfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade dtb-marvellUpgrade dtb-lgUpgrade dtb-caviumUpgrade dtb-appleUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade kernel-64kb-devel | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-generic-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-aws-64kUpgrade linux-image-genericUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-awsUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-oracleUpgrade linux-image-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-generic-64k-hwe-24.04 | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub