CVE-2026-89523 wifi: mt76: mt7925: cancel pending mlo_pm_work
A use-after-free vulnerability in the mt7925 Wi-Fi driver allows attackers to cause system crashes or potentially execute code during device reset or suspend operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89523?
CVE-2026-89523 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: cancel pending mlo_pm_work
If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the firmware is not available.
Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown and suspend paths:
- mt7925_mac_reset_work() (chip reset recovery) - mt7925e_unregister_device() (PCIe unbind) - mt7925_pci_suspend() (PCIe bus suspend) - mt7925_suspend() (mac80211 suspend) - mt7925u_suspend() (USB bus / runtime suspend)
This ensures the work is stopped before the device state becomes invalid.
Which versions are affected by CVE-2026-89523?
How do I fix CVE-2026-89523?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89523 being exploited?
There is no known exploitation of CVE-2026-89523 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89523, DEBIAN-CVE-2026-89523, GHSA-2cmm-rm3g-hc7x, UBUNTU-CVE-2026-89523.