CVE-2026-63832

Received Received - Intake

Memory Corruption in MediaTek mt76 WiFi Driver

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63832

EUVD

EUVD-2026-45498

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a corruption issue in the wifi driver mt76, specifically affecting the mt7925 and mt76 modules. It occurs when the wcid (wireless client identifier) is reinitialized due to missing a publish check in mt76_sta_add, leading to a list corruption in dev->sta_poll_list. This corruption causes prev->next to point to itself, resulting in a slab kmalloc-8k corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's mt76 WiFi driver, particularly affecting mt7925 hardware. Detection requires checking kernel logs for corruption messages like 'list_add corruption' or 'slab kmalloc-8k' errors related to mt76 or mt7925 modules. Use commands like 'dmesg | grep -i corruption' or 'journalctl -k | grep -i mt76' to search for these patterns.

Impact Analysis

This vulnerability can cause system instability, crashes, or unexpected behavior in systems using affected Linux kernel wifi drivers. It may lead to denial of service conditions, data corruption, or security issues due to memory corruption in the kernel.

Compliance Impact

This vulnerability does not provide sufficient information to determine its impact on compliance with standards like GDPR or HIPAA. The issue appears to be a memory corruption bug in the Linux kernel's WiFi driver (mt76) affecting wireless connectivity, but no details are provided about data exposure, access control, or privacy implications.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this issue. Check your distribution's updates or kernel.org for the latest stable release. If using affected mt76/mt7925 drivers, consider temporarily disabling the WiFi interface or switching to a wired connection until patched.

Hi! I’m here to help you understand CVE-2026-63832. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70