The vulnerability in the Linux kernel's mt76 wifi driver (mt7996) arises because mt7996_mac_reset_work() disables the TX worker and RX/TX NAPIs before acquiring the dev->mt76.mutex. Since mt76_worker_disable() and _enable() are simple thread park/unpark operations without reference counting, a race condition can occur during an L1 SER (single event recovery) and channel switch. This race can cause the TX worker to be unparked and the MT76_RESET bit cleared while the reset path resets DMA rings, potentially corrupting descriptors or tokens. The fix involves acquiring the mutex before disabling the worker, aligning with the approach used in the mt7915 driver.

If exploited, this race condition can cause corruption of DMA descriptors or tokens in the wifi driver, potentially leading to denial of service or other unpredictable behavior affecting wifi functionality. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability.

The vulnerability has been resolved in the Linux kernel by ensuring the dev->mt76.mutex is held while disabling the TX worker during reset operations. Users should apply the official Linux kernel updates that include this fix. No additional mitigation steps are indicated.