CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: cancel pending mlo_pm_work

If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the firmware is not available.

Add cancel_delayed_work_sync(&dev->mlo_pm_work) in all relevant teardown and suspend paths:

• mt7925_mac_reset_work() (chip reset recovery)
• mt7925e_unregister_device() (PCIe unbind)
• mt7925_pci_suspend() (PCIe bus suspend)
• mt7925_suspend() (mac80211 suspend)
• mt7925u_suspend() (USB bus / runtime suspend)

This ensures the work is stopped before the device state becomes invalid.