The Linux kernel mt7996 wireless driver had a use-after-free (UAF) vulnerability in the mt7996_mac_dump_work() function. During device removal, the crash data structure is freed in mt7996_coredump_unregister(), but a queued work item (dump_work) could still be executing or pending, causing the freed memory to be accessed again. This race condition arises between the removal path and the workqueue execution. The vulnerability was addressed by adding cancel_work_sync() in mt7996_unregister_device() to ensure any pending or running dump work is completed or canceled before the crash data is deallocated.

The vulnerability could lead to use-after-free memory access in the kernel, which may cause system instability, crashes, or potentially allow escalation of privileges or arbitrary code execution in kernel context if exploited. However, no known exploits in the wild have been reported.

A fix is available that properly cancels the pending dump work before freeing the crash data by adding cancel_work_sync() in the mt7996_unregister_device() function. Users should update to Linux kernel versions 7.0.0-28.28.1 or later where this fix is included.