The Linux kernel mt7915 wireless driver contained a use-after-free (UAF) vulnerability in the mt7915_mac_dump_work() function. When the mt7915 PCI chip is removed, the crash data structure is freed in mt7915_coredump_unregister(). However, a workqueue item (dump_work) that accesses this crash data may still be executing or queued, causing a race condition and UAF when it dereferences the freed memory. The vulnerability is resolved by adding cancel_work_sync() in mt7915_unregister_device() to ensure the work item is fully canceled before the crash data is deallocated.

Exploitation of this use-after-free vulnerability could lead to undefined behavior such as kernel crashes or potential escalation of privileges if an attacker can trigger the race condition. However, no known exploits in the wild have been reported. The impact is limited to systems using the affected mt7915 wireless driver in the Linux kernel.

A fix is available that properly cancels the dump_work work item before freeing the crash data, preventing the use-after-free condition. Users should update to Linux kernel versions 7.0.0-28.28.1 or later where this issue is resolved. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor is the recommended remediation.