The Linux kernel mt76 WiFi driver had a vulnerability where the function mt76_sta_add did not properly check if a wcid (wireless client ID) was already published before reinitializing the wcid->poll_list. This led to corruption of the dev->sta_poll_list, observed as a list_add corruption where prev->next pointed to itself, causing kernel memory corruption and disconnects from WiFi access points. The fix involved adding a publish check in mt76_sta_add to prevent reinitialization of the poll list if the wcid was already published. The issue was found when using the mt7925 driver and kernel version 7.1-rc4.

This vulnerability can cause kernel memory corruption in the WiFi driver, leading to denial of service conditions such as unexpected disconnections from WiFi access points. The CVSS score of 8.8 indicates high impact on confidentiality, integrity, and availability, but no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel by adding a wcid publish check in the mt76_sta_add function to prevent poll list corruption. Users should update their Linux kernel to a version that includes this patch. Since no vendor advisory or patch links are provided, check the official Linux kernel release notes or distribution security advisories for the fixed version. Patch status is not yet confirmed in this data — verify with vendor sources for current remediation guidance.