NULL-pointer Dereference in MediaTek MT76 WiFi Driver

Executive Summary

This is a NULL-pointer dereference vulnerability in the Linux kernel's mt76 Wi-Fi driver, specifically affecting the mt7996 chipset. The issue occurs in the mt7996_mcu_sta_bfer_eht function where a pointer returned by mt76_connac_get_eht_phy_cap may be NULL. The code fails to check this pointer before attempting to dereference it, which could lead to a system crash or other unexpected behavior.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's mt76 driver for MediaTek MT7996 WiFi chips. Detection requires checking the kernel version and driver in use. Use commands like 'uname -a' to check kernel version and 'lsmod | grep mt76' to verify the mt76 driver is loaded. If the driver is present and the kernel is affected, the vulnerability may exist.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could cause a kernel panic or system instability, leading to denial of service. An attacker within Wi-Fi range could potentially trigger this issue by sending specially crafted network traffic, disrupting network connectivity or causing the affected device to crash.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a NULL-pointer dereference in the Linux kernel's wifi driver (mt76: mt7996). It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel-level software bugs. However, if exploited, it could lead to system instability or crashes, potentially disrupting services that handle sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-68306. This resolves the NULL-pointer dereference in the mt76 driver. Check your distribution's security updates or kernel patches to apply the fix immediately.

Useful 0 Not Useful 0