The Linux kernel mt76 WiFi driver contained a memory leak vulnerability where the function mt76_connac_mcu_alloc_sta_req() allocates an skb buffer expected to be freed by mt76_mcu_skb_send_msg(). However, if intermediate functions such as mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() fail before sending the message, the allocated skb is not freed, causing a memory leak. This was identified through static analysis and code review. The issue was fixed by explicitly freeing the skb in these error paths. A similar fix was previously applied in commit 7c0f63fe37a5 for the mt7996 variant.

The vulnerability causes a memory leak in the Linux kernel WiFi driver, which could lead to increased memory consumption and potential system instability or denial of service over time if the error path is triggered repeatedly. There is no indication of direct code execution or privilege escalation from this issue. No known exploits are reported in the wild.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to these or newer versions to remediate the memory leak. Since this is a kernel-level fix, applying the official kernel update from the vendor is the recommended remediation. No additional mitigations are specified or required.