CVE-2026-68307
Received Received - Intake

Kernel Crash in MT76 WiFi Driver Due to NULL bss_conf

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links. After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily contain a link whose mac80211 bss_conf has already gone away. This can pass a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), matching the crash where x1, the second argument, is NULL: pc : mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] lr : mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] x2 : ffffff80a77f6018 x1 : 0000000000000000 x0 : ffffff8099402080 Call trace: mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common] Skip missing bss_conf entries before replaying the link. Non-MLO AP/STA reset replay is unchanged because the helper still returns &vif->bss_conf for the legacy link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68307
EUVD
EUVD-2026-55408

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the mt76 Wi-Fi driver for MediaTek MT7925 devices. It occurs during reset recovery when the driver attempts to replay firmware state for wireless links. A crash happens because the driver may try to access a NULL pointer (bss_conf) that was already freed or invalid, leading to a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's mt76 WiFi driver for MT7925 devices. Detection requires checking kernel logs for crashes related to mt76_connac_mcu_uni_add_dev or mt7925_vif_connect_iter during WiFi operations. Monitor logs with: dmesg | grep mt76_connac_mcu_uni_add_dev or journalctl -k | grep mt7925_vif_connect_iter.

Impact Analysis

If exploited, this vulnerability could cause system instability or crashes on affected Linux devices using the mt76 Wi-Fi driver with MediaTek MT7925 hardware. It may lead to denial-of-service conditions where the system becomes unresponsive or requires a reboot.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. If updating is not immediately possible, avoid triggering WiFi reset operations or MLO link changes until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68307. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart