{"id":"CVE-2026-89523","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89523","summary":"wifi: mt76: mt7925: cancel pending mlo_pm_work","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: cancel pending mlo_pm_work\n\nIf the device is reset, suspended or unregistered within that window,\nthe pending work can still run and access vif/bss data that may already\nbe freed, or send MCU commands while the firmware is not available.\n\nAdd cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown\nand suspend paths:\n\n - mt7925_mac_reset_work()        (chip reset recovery)\n - mt7925e_unregister_device()    (PCIe unbind)\n - mt7925_pci_suspend()           (PCIe bus suspend)\n - mt7925_suspend()               (mac80211 suspend)\n - mt7925u_suspend()              (USB bus / runtime suspend)\n\nThis ensures the work is stopped before the device state becomes\ninvalid.","published":"2026-09-11T19:44:04.796Z","modified":"2026-09-14T03:46:12.217914876Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.18.50"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2889e84282dda147f10b10d94cf0efd90a349c53"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5be6d02837d418bc6c805b5cab1b338de6de9ca7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c5e073f2fbfd34d22099a50d96f60990799753e2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89523.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89523"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T03:46:12.217914876Z"}}