Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER mt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex. An L1 SER racing a channel switch could therefore have the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens. Take the mutex before disabling the worker, as mt7915 does.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
27015b6fbcca836c6dbf196afc266e068af4aeec to < bc4f4389f439e808185778d298da36976d13d415affected27015b6fbcca836c6dbf196afc266e068af4aeec to < 69f23622533a4f054b5c8fdb226c3319ffa017b6affected27015b6fbcca836c6dbf196afc266e068af4aeec to < 906ad486ba5c4933d82e1ebe0685656390a48450affected27015b6fbcca836c6dbf196afc266e068af4aeec to < 594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701affected27015b6fbcca836c6dbf196afc266e068af4aeec to < 6190db312b8230813f529f014b26247c6d9800d0affected
Linux Linux
Default version status: affected
6.4affected0 to < 6.4unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/bc4f4389f439e808185778d298da36976d13d415 ↗
- https://git.kernel.org/stable/c/69f23622533a4f054b5c8fdb226c3319ffa017b6 ↗
- https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450 ↗
- https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701 ↗
- https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0 ↗