CVE-2026-68193
Received Received - Intake

NULL Pointer Dereference in Linux Kernel mt76 WiFi Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatch it to mt7925_mac_tx_free() on every bus. mt7925_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7925_mac_tx_free+0x58/0x350 [mt7925_common] mt7925_rx_check+0xe2/0x130 [mt7925_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68193
EUVD
EUVD-2026-55294

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7925 chipset. It involves a NULL pointer dereference when handling a TXRX_NOTIFY event on non-MMIO buses like USB. The event is incorrectly dispatched to a function that expects MMIO-based hardware, leading to a crash.

Detection Guidance

This vulnerability may cause a kernel NULL pointer dereference on systems using USB-based MT76 WiFi devices. Detection involves checking kernel logs for NULL pointer dereference errors related to mt76_usb or mt7925_mac_tx_free. Monitor logs with: dmesg | grep -i 'NULL pointer dereference' or journalctl -k | grep -i 'NULL pointer dereference'.

Impact Analysis

If you use a device with a mt7925 WiFi chipset connected via USB, this vulnerability could cause your system to crash with a kernel panic. This would result in a sudden loss of network connectivity and potential data loss.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. If using affected MT76 USB WiFi devices, avoid using them until the kernel is updated. Monitor vendor advisories for driver or firmware updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart