CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's mt76 driver for the mt7915 Wi-Fi chipset, where an improperly managed TWT (Target Wake Time) flow can lead to memory corruption. If the firmware rejects the TWT agreement, the flow remains linked in the list without proper cleanup, potentially causing a dangling pointer issue during subsequent operations. Organizations using affected Linux systems with mt7915 chipsets should prioritize remediation to prevent potential exploitation that could lead to system instability or security breaches.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.