CVE-2026-98957 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using the mt7915e module, should assess exposure and apply patches to prevent system instability. This includes verifying the Linux kernel version, reviewing system configurations for mt7915e module usage, and monitoring system stability. Security teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-98957 is a vulnerability in the Linux kernel's wifi mt76 mt7915 driver that can cause system instability. Defenders should prioritize verifying the Linux kernel version and applying patches to disable rx napi when removing the device.

• Verify Linux kernel version and apply patches to disable rx napi when removing the device
• Review system configurations for mt7915e module usage and update as necessary
• Monitor system stability and apply fixes if experiencing issues with module unloading and reinsertion

Technical summary

The Linux kernel's wifi mt76 mt7915 driver does not disable rx napi when removing the device, causing system instability when unloading and reinserting the mt7915e module. This issue is fixed in later kernel versions with patches that disable rx napi. The fix involves adding a call to napi_disable() before destroying the napi, preventing warnings in __netif_napi_del_locked() and page_pool_disable_direct_recycling(). Defenders should prioritize verifying the Linux kernel version and applying patches to disable rx napi when removing the device.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and applying patches to disable rx napi when removing the device, particularly for systems using the mt7915e module.

Recommended defensive actions

• Verify Linux kernel version and apply patches to disable rx napi when removing the device
• Review system configurations for mt7915e module usage and update as necessary
• Monitor system stability and apply fixes if experiencing issues with module unloading and reinsertion
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected Linux kernel versions and the necessary patches to fix the issue. Defenders should verify the Linux kernel version and apply patches to disable rx napi when removing the device. The issue arises because the driver does not disable rx napi before destroying it, leading to multiple warnings in __netif_napi_del_locked() and page_pool_disable_direct_recycling().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.