I also found a security issue. I’m not going to disclose it yet and be vague on details. I’m only comfortable posting on this public forum about it all because it would be extremely hard for a bad actor to create the conditions to take advantage of it, especially externally, but not impossible if a bad actor could stage a Wi-Fi environment in a specific way but it’s more likely to cause a panic than actually work because of the tight timing required to beat a specific race. I sent it off to the appropriate channels for analysis and have already mitigated it in my patches. Low risk but high severity if exploited.
3 Likes
Resubmitted my 17 patches to the LKMLs after some feedback.
4 Likes
I had a similar issue (on arch it doesn’t panic exactly, the module just dies) but I am not knowledgable enough in linux dev to debug it. The module would fail when moving between mesh networks, and I’d need to unload and reload it.
I had an intel wifi board lying around so I just switched to that instead, but good to hear someone is getting to the bottom of it!
Thanks for submitting them upstream @Zac_Bowling!
Let us know if you need any help - also feel free to cc linux@frame.work on the patches. We can test and send a Tested-By
I did let AMD (Mario above) and Mediatek know about this.
4 Likes
Thanks Daniel! I sent all the patches up to LKML. I’ll add you guys on future rebase patch versions. I installed the older mi7921 chip and I’m testing a backport of the changes to that driver. The same race bug exists there but it’s much harder to reproduce given the lack of hardware support for MLO.
4 Likes
This is amazing work, thank you! Do these patches also solve the issues in preventing the system from going to sleep or hibernate? Or was that already addressed in later kernel versions? Linux 6.12.63 and 6.12.64 seem to either hang or not suspend at all with the mt7925.
1 Like
I’m experiencing the same issues on pop_os. @Zac_Bowling do you know if I can use your patches? I’m on kernel 6.17.9. which is the most recent kernel for pop.
I don’t think so. Might be a different issue
Sure. You will have to rebuild your kernel though which is a bit of work and I don’t have a how-to guide. But 6.17.9 is the latest for Ubuntu 25.04 too and my initial patches worked on that kernel, but then I also just switched to 6.18.2 and even have 6.19-rc4 running too.
You have to be comfortable enough to rebuild your kernel if you can manage that, apply the patches is trivial. Why I’ve been working to get this landed upstream so then it’s easier to then go to distro vendors can get them to backport the fixes to their LTS and stable kernels once upstream.
1 Like
I can speak to how correct these instructions are. Generated with AI looking at my bash history.
Building MT7925 WiFi Fixes on Debian/Ubuntu/Pop_OS/Mint/etc
This guide covers building the MT7925 WiFi driver patches on Ubuntu or Pop_OS with kernel 6.17 or 6.18. There is also a 6.19 RC patch directory in the repo.
Prerequisites
sudo apt update
sudo apt install build-essential libncurses-dev bison flex libssl-dev libelf-dev ccache git
You will probably also need some rust build packages. I forget what they are.
Option 1: Build Just the mt76 Module (Quick - Recommended)
These instructions might not work anymore… it’s been a minute since I tried this
This method only rebuilds the WiFi driver modules, which is much faster than a full kernel build. I do this anyways so I can debug other issues.
# Install kernel headers and source
sudo apt install linux-headers-$(uname -r)
apt-get source linux-image-$(uname -r)
cd linux-*/
# Clone the patches
git clone https://github.com/zbowling/mt7925.git ~/mt7925-patches
# Apply patches (use patches/mt7925 folder for 6.17/6.18 kernels)
for patch in ~/mt7925-patches/patches/mt7925/000[1-9]-*.patch \
~/mt7925-patches/patches/mt7925/001[0-7]-*.patch; do
patch -p1 < "$patch" || echo "May need adjustment: $patch"
done
# Build just mt76 modules
make -C /lib/modules/$(uname -r)/build M=$(pwd)/drivers/net/wireless/mediatek/mt76 modules
# Backup existing modules (optional but recommended)
sudo cp /lib/modules/$(uname -r)/kernel/drivers/net/wireless/mediatek/mt76/*.ko \
/lib/modules/$(uname -r)/kernel/drivers/net/wireless/mediatek/mt76/*.ko.bak 2>/dev/null
# Install new modules
sudo make -C /lib/modules/$(uname -r)/build M=$(pwd)/drivers/net/wireless/mediatek/mt76 modules_install
sudo depmod -a
# Reboot to load new modules
sudo reboot
Option 2: Full Kernel Build
Use this if you want to build and install a complete patched kernel.
# Get kernel source
git clone --depth 1 --branch v6.17 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
cd linux
# Clone and apply patches
git clone https://github.com/zbowling/mt7925.git ~/mt7925-patches
for patch in ~/mt7925-patches/patches/mt7925/000[1-9]-*.patch \
~/mt7925-patches/patches/mt7925/001[0-7]-*.patch; do
git apply "$patch" || echo "May need adjustment: $patch"
done
# Configure using your current kernel's config
cp /boot/config-$(uname -r) .config
make olddefconfig
# Build (using ccache speeds up rebuilds significantly)
make CC="ccache gcc" -j$(nproc)
make CC="ccache gcc" modules -j$(nproc)
# Install
sudo make modules_install
sudo make install
sudo update-initramfs -c -k 6.17.0+
sudo update-grub
# Reboot into new kernel
sudo reboot
For Kernel 6.19-rc4 or Newer
If you’re on kernel 6.19-rc4 or newer, use the linux-6.19-rc4/ folder instead:
for patch in ~/mt7925-patches/linux-6.19-rc4/*.patch; do
patch -p1 < "$patch" || git apply "$patch"
done
Verification
After rebooting, verify the patched modules are loaded:
# Check module is loaded
lsmod | grep mt7925
# Check for any errors
dmesg | grep -i mt7925
# Verify module version changed (srcversion will be different from stock)
modinfo mt7925_common | grep srcversion
Troubleshooting
Patches fail to apply
If patches fail with “Hunk FAILED”, the kernel source may have diverged. Try:
- Check if there’s a unified patch:
~/mt7925-patches/patches/mt7925/mt7925_unified.patch - Apply patches manually, adjusting line numbers as needed
- Open an issue at GitHub · Where software is built
Module won’t load
# Check for signature issues (if Secure Boot is enabled)
sudo mokutil --sb-state
# Try loading manually to see errors
sudo modprobe -r mt7925e mt7925_common mt792x_lib mt76_connac_lib mt76
sudo modprobe mt76
sudo modprobe mt76_connac_lib
sudo modprobe mt792x_lib
sudo modprobe mt7925_common
sudo modprobe mt7925e
WiFi still crashes
Check kernel logs for clues:
sudo dmesg -w | grep -i mt7925
Report issues with full dmesg output at: GitHub · Where software is built
1 Like
Building MT7925 WiFi Fixes on CachyOS (and might hint how you can do this for other Arch distros)
This guide covers building a patched kernel with MT7925 WiFi driver fixes for CachyOS.
Prerequisites
sudo pacman -S base-devel git ccache
Configure ccache for Kernel Builds
Kernel builds are large - increase ccache size to 20GB for best results:
# Set cache size to 20GB
ccache -M 20G
# Verify settings
ccache -s
Option 1: CachyOS Kernel with Patches (Recommended)
This method builds a CachyOS kernel with all MT7925 patches applied.
Setup Build Directory
mkdir -p ~/cachyos-kernel-build/build
cd ~/cachyos-kernel-build
# Clone CachyOS kernel PKGBUILD
git clone https://github.com/CachyOS/linux-cachyos.git
cp -r linux-cachyos/linux-cachyos/* build/
cd build
Get the Patches
# Clone the patches repo
git clone https://github.com/zbowling/mt7925.git ~/mt7925-patches
# Copy patches to build directory (for kernel 6.18.x)
cp ~/mt7925-patches/patches/mt7925/000[1-9]-*.patch .
cp ~/mt7925-patches/patches/mt7925/001[0-7]-*.patch .
# Or for kernel 6.19+
# cp ~/mt7925-patches/linux-6.19-rc4/*.patch .
Modify PKGBUILD
Edit the PKGBUILD to add the patches. Add the patch filenames to the source array and corresponding checksums to b2sums:
# Add to source array (after the config line):
source=(
...
"0001-wifi-mt76-mt7925-fix-NULL-pointer-dereference-in-vif.patch"
"0002-wifi-mt76-mt7925-fix-missing-mutex-protection-in-res.patch"
# ... add all patches
)
# Add 'SKIP' entries to b2sums for each patch:
b2sums=(
...
'SKIP' # 0001 patch
'SKIP' # 0002 patch
# ... one SKIP per patch
)
In the prepare() function, add patch application after the CachyOS patches:
prepare() {
...
# After existing patches, add:
echo "Applying MT7925 WiFi fixes..."
local src
for src in "${source[@]}"; do
src="${src%%::*}"
src="${src##*/}"
[[ $src = 0*.patch ]] || continue
echo "Applying patch $src..."
patch -Np1 < "../$src"
done
}
Optional: Customize Package Name
To distinguish from stock CachyOS kernel:
# Change in PKGBUILD:
_pkgsuffix=cachyos-wifi-fix
pkgrel=1 # increment if rebuilding
Build
# Build the kernel
makepkg -sf
# This will produce packages like:
# linux-cachyos-wifi-fix-6.18.4-1-x86_64.pkg.tar.zst
# linux-cachyos-wifi-fix-headers-6.18.4-1-x86_64.pkg.tar.zst
Install
sudo pacman -U linux-cachyos-wifi-fix-*.pkg.tar.zst
Reboot
Select the new kernel in your bootloader, or if using systemd-boot/GRUB, it should be default.
sudo reboot
Option 2: Build Module Only (Quick Test)
For quick testing without rebuilding the entire kernel:
# Install kernel headers
sudo pacman -S linux-headers # or linux-cachyos-headers
# Get kernel source matching your version
KVER=$(uname -r | sed 's/-.*//')
git clone --depth 1 --branch v$KVER https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
cd linux
# Apply patches
git clone https://github.com/zbowling/mt7925.git ~/mt7925-patches
for patch in ~/mt7925-patches/patches/mt7925/000[1-9]-*.patch \
~/mt7925-patches/patches/mt7925/001[0-7]-*.patch; do
patch -p1 < "$patch" || echo "May need adjustment: $patch"
done
# Prepare for module build
zcat /proc/config.gz > .config
make olddefconfig
make modules_prepare
# Build just mt76 modules
make -j$(nproc) M=drivers/net/wireless/mediatek/mt76
# Install modules
sudo make M=drivers/net/wireless/mediatek/mt76 modules_install
sudo depmod -a
# Reload modules
sudo modprobe -r mt7925e mt7925_common mt792x_lib mt76_connac_lib mt76
sudo modprobe mt7925e
# Or just reboot
sudo reboot
Verification
# Check kernel version
uname -r
# Check module loaded
lsmod | grep mt7925
# Check for errors
dmesg | grep -i mt7925
# Verify srcversion changed
modinfo mt7925_common | grep srcversion
Troubleshooting
Build fails with patch errors
The patches are written for specific kernel versions. If patches fail:
- Check your kernel version:
uname -r - Try the patches from
linux-6.19-rc4/folder for newer kernels - Try the unified patch:
patches/mt7925/mt7925_unified.patch
Kernel won’t boot
Boot into the previous kernel from your bootloader menu and remove the broken package:
sudo pacman -R linux-cachyos-wifi-fix linux-cachyos-wifi-fix-headers
1 Like
Had a chance to try out the patches under NixOS, configuration here, and while I only rebooted my machine recently, things didn’t blow up yet!
Patch 13, 14, and 15 failed to apply, though. Is that expected for 6.18.4?
Edit: The unified patch applies fine
Seems like the unified patch is missing patches 13, 14, and 15
Edit: I’m continually updating my NixOS config to contain the latest patches by Zac. If anyone else is using NixOS, feel free to copy my config linked above. (Why was this reported as spam??)
There is a different directory of patches that might apply more cleanly. Sorry, it’s difficult maintaining patch sets for multiple kernel versions and forks 
A few functions moved around and changed signatures across 6.17 to 6.19 and the hunks fail to apply cleanly sometimes.
The first 3 patches will keep the wifi firmware from at least crashing your machine. The last patches stop different types of deadlocks that can hang NetworkManger and other services when the firmware is struggling in other ways. If you don’t have the last set of patches then you probably won’t panic anymore but you can still have deadlocks in the driver in specific circumstances and that lock up NetworkManager, plasma, certain gnome guis, cli tools, etc. At least if you do, won’t loose work and can reboot.
There are still bugs in the MediaTek firmware that isn’t open source that I can’t fix around MLO and deauth issues in certain conditions (I can see the error messages but there is nothing I can do directly), but these patches at least allow the device to reset and reload when it happens and it at least stops that from taking your kernel down with it and avoid needing to reboot less often and you can keep mostly chugging along even if you have some momentary disconnects and while the device resets and reconnects in certain error conditions.
I don’t see as many bugs with the older Wifi 6E mi7921 chip. It doesn’t support MLO so that makes some sense since they’re few state transitions for things to go wrong. I also ordered the new mi7927 chip off AliExpress. I heard the Linux driver for that even newer chipset is a hot mess.
It sucks the Intel AX wifi chips aren’t really supported on Ryzen. AMD worked with MediaTek to release these chipsets since Intel was locking up their wifi chips to their CPUs (although there are work arounds to fix that). The only other option is some Qualcomm and broadcom M.2 wifi modules but Bluetooth is a hot mess on some of these chips.
1 Like
Hey, I know it’s not absolutely perfect, but you turned my system from freezing and panicking within a half-hour of uptime to the system actually being usable with WiFi enabled. I don’t know how to thank you enough for saving myself and other users from countless hours of frustration
I’ve gone ahead and packaged my MT7925 WiFi driver fixes as a DKMS module, making it much easier to install and maintain. No more manually patching and rebuilding your kernel! Hoping MediaTek and AMD can land these changes upstream and this won’t be necessary long term, but in the mean time this makes it bit easier to use these patches.
What This Fixes
- Kernel panics with NULL pointer dereference in mt7925
- System hangs during WiFi network switching
- Mutex deadlocks during suspend/resume
- Processes stuck in D state (uninterruptible sleep)
Requirements
- Kernel 6.17 or newer (Fedora 42, Arch, CachyOS, Ubuntu 25.10+)
- I have #ifdefs that should work for 6.17, 6.18, and 6.19-rc kernels
- DKMS installed
- Kernel headers for your running kernel
- Clang + lld if your kernel was built with clang (Arch, CachyOS)
Installation
# Arch/CachyOS:
sudo pacman -S dkms linux-headers clang lld
# Fedora:
sudo dnf install dkms kernel-devel
# Ubuntu 25.10+:
sudo apt install dkms linux-headers-generic
# Clone and install
git clone https://github.com/zbowling/mt7925.git
cd mt7925/dkms
sudo ./install.sh
That’s it! The installer will:
- Check your kernel version and dependencies
- Detect if you need clang (auto-configured)
- Build and install 5 patched mt76 modules
- Blacklist the stock modules
- Load the new modules
Verify It’s Working
dkms status | grep mt76
# Should show: mt76-mt7925/1.0.0, <your-kernel>, x86_64: installed
lsmod | grep mt7925
# Should show mt7925e and related modules loaded
Automatic Kernel Updates
The best part: when you update your kernel, DKMS automatically rebuilds the patched modules. No manual intervention needed.
Uninstall
If you need to remove it:
cd mt7925/dkms
sudo ./uninstall.sh
This removes the DKMS package and restores the stock kernel modules.
For Older Kernels (Ubuntu 24.04, etc.)
If you’re on kernel < 6.17, the DKMS package won’t work due to missing kernel APIs. You’ll need to either:
- Upgrade to a newer kernel
- Apply the patches directly to your kernel source (see the kernels/ directory in the repo for version-specific patches). I can’t help you here because the older kernels are very different now but some of the fixes might apply
Links
- Repository: GitHub - zbowling/mt7925: Fixes for crashes in MediaTek mt7925
- All 18 patches have been submitted to LKML for upstream inclusion
Let me know if you run into any issues!
3 Likes
I updated all the patch sets and for multiple kernels now and even created some CI jobs to validate the patches apply cleanly going forward as I maintain this until upstream lands this.
2 Likes
Thank you for the patch!
I haven’t been able to fully use my laptop (the newer Framework 16) for the last 2 months because of this issue. After installing the patch, the issue is indeed gone and I can use my computer normally.
1 Like
I’m working to try out the dkms repo. Thank you Zac! But getting gcc-15 is annoyingly non-trivial!
1 Like
Which distro are you on? The DKMS module will try to compile with the same toolchain your stock kernel was compiled with to avoid issues.
Mint. It has gcc-12, and the dkms build wanted gcc-15. I’ve wiped it and put ubuntu, but not before spending quite a lot of effort to get mint to work.
Update: Now with ubuntu, it works just fine, first try.
1 Like
This is awesome work, and exactly what the FOSS community is about!
1 Like