CVE-2026-68195
Received Received - Intake

Null Pointer Dereference in MediaTek MT7615 WiFi Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7615_rx_check() and mt7615_queue_rx_skb() dispatch it to mt7615_mac_tx_free() on every bus. mt7615_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on the mt7663 USB and SDIO buses it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker. Same defect as the mt7921 and mt7925 patches in this series. Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68195
EUVD
EUVD-2026-55296

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the mt7615 Wi-Fi driver. It involves a NULL pointer dereference in the RX worker when handling the PKT_TYPE_TXRX_NOTIFY event on non-mmio buses like USB or SDIO. The event is incorrectly dispatched to mt7615_mac_tx_free(), which calls a NULL tx_cleanup callback, causing a crash.

Detection Guidance

This vulnerability affects specific Mediatek WiFi chipsets (mt7615) on non-MMIO buses like USB or SDIO. Detection requires checking kernel logs for NULL pointer dereference errors in the mt76 driver during WiFi operations. Monitor dmesg for crashes or errors related to mt7615_rx_check or mt7615_mac_tx_free.

Impact Analysis

If you use affected devices with mt7615 Wi-Fi chips on USB or SDIO buses, this flaw could cause system instability or crashes when receiving specific network packets. It may lead to denial-of-service conditions on the affected system.

Mitigation Strategies

Apply the latest Linux kernel updates to ensure the fix is included. If using affected Mediatek WiFi devices (mt7615 on USB/SDIO), consider disabling the device or switching to an MMIO-based connection if possible. Monitor vendor advisories for driver updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart