CVE-2026-89523 Linux kernel CVE debrief

Who should care

Defenders responsible for Linux kernel systems using mt7925 devices should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and apply patches, review system configurations, and assess potential impacts on their systems and operations.

Why it matters

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly for systems using mt7925 devices, to prevent potential issues.

• Verify patch application for mt7925 devices
• Assess system configurations for potential exposure

Technical summary

The Linux kernel's mt76 driver has a vulnerability that can cause pending work to run and access freed data or send MCU commands while the firmware is unavailable. The fix involves adding cancel_delayed_work_sync(&dev->mlo_pm_work) in relevant teardown and suspend paths, such as mt7925_mac_reset_work(), mt7925e_unregister_device(), mt7925_pci_suspend(), mt7925_suspend(), and mt7925u_suspend(). This ensures the work is stopped before the device state becomes invalid, preventing potential issues with data access or firmware availability.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly for systems using mt7925 devices.

Recommended defensive actions

• Verify Linux kernel versions for mt7925 device usage
• Apply patches for affected systems
• Review system configurations for mt7925 devices
• Assess exposure and prioritize patching for Linux kernel systems using mt7925 devices
• Verify patch application for mt7925 devices
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references provide details on the vulnerability and fix in the Linux kernel's mt76 driver. To verify and apply patches, defenders should review the official advisory and assess system configurations for potential exposure. The fix involves adding cancel_delayed_work_sync(&dev->mlo_pm_work) in relevant teardown and suspend paths. Evidence limits are based on source-provided information, and defenders should verify patch application for mt7925 devices.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.