CVE-2026-63866

A flaw was found in the Linux kernel's mt76 Wi-Fi driver for mt7996 devices. This vulnerability occurs when the mt7996macstadeinitlink routine fails to properly clear a Wireless Client ID WCID pointer when removing a station link. This improper handling of the WCID pointer may lead to a resource...

CVE-2026-63866 wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996macstadeinitlink Clear WCID pointer removing the sta link in mt7996macstadeinitlink routine...

CVE-2026-63832 wifi: mt76: add wcid publish check in mt76_sta_add

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76staadd Since mt7925macstaadd publishes wcid, add publish check in mt76staadd to avoid reinitializing the wcid-polllist. Found dev-stapolllist corruption when using mt7925 and 7.1-rc4...

CVE-2026-63832 wifi: mt76: add wcid publish check in mt76_sta_add

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76staadd Since mt7925macstaadd publishes wcid, add publish check in mt76staadd to avoid reinitializing the wcid-polllist. Found dev-stapolllist corruption when using mt7925 and 7.1-rc4...

UBUNTU-CVE-2026-53317

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID over 20 causes a firmware crash. This situation occurred in our testing using an AP interface on 7922 hardware, with a modified hostapd,...

CVE-2026-53104

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability, a memory leak, occurs when the device is destroyed during module unload. Specifically, the mt76dmacleanup routine fails to properly destroy the pagepool associated with all MT76 receive queues, leading to unreleased...

CVE-2026-53100

A flaw was found in the Linux kernel's mt76 wireless driver. This vulnerability occurs in the remain-on-channel functionality, where the mt76remainonchannel and mt76roccomplete functions attempt to acquire a mutex that is already held. This improper handling of the device mutex can lead to a syst...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fixed a possible memory leak in the mt7915mcuaddsta routine. The allocated skb was freed in the mt7915mcuaddsta routine in case of failures...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fixed a kernel crash when calling mt7921pciremove The crash log indicates that it is possible that mt7921irqhandler was called while devmfreeirq was being processed. Therefore, mt76freedevice needs to be postponed...

CVE-2026-23315

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability, an out-of-bounds OOB access, occurs due to an insufficient check of frame length before accessing management fields within the mt76connac2macwritetxwi80211 function. An attacker could potentially exploit this to cause...

CVE-2026-23363 wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925macwritetxwi80211 Check frame length before accessing the mgmt fields in mt7925macwritetxwi80211 in order to avoid a possible oob access...

CVE-2026-23325 wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible oob access in mt7996macwritetxwi80211 Check frame length before accessing the mgmt fields in mt7996macwritetxwi80211 in order to avoid a possible oob access...

CVE-2026-23315

The CVE affects the Linux kernel mt76 wifi driver (mt76_connac2_mac_write_txwi_80211). The root cause is that the function could perform an out-of-bounds access by not validating the frame length before accessing management fields, including mgmt->u.action.u.addba_req.capab. This could enable ...

CVE-2025-68765

The CVE-2025-68765 issue is in the Linux kernel’s mt7615 driver: in mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated and, if mt76_connac_mcu_alloc_wtbl_req() fails, it is not freed, causing a memory leak. The published fix ensures sskb is freed via dev_kfree_skb() in the error path. Affected c...

CVE-2022-50735

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76ustatusworker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76ustatusworker thread if the device is not running yet. KASAN: null-ptr-deref in range...

CVE-2025-68360 wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wedhif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary w...

kernel: wifi: mt76: fix linked list corruption

A flaw was found in the linux kernal wifi subsystem mt76txqschedulependingwcid and mt76txqschedulepending functions of the mt76 driver. Under certain conditions, scheduled wcid entries are left on a temporary on‑stack list, which may lead to linked‑list corruption and memory corruption, allowing ...

kernel: wifi: mt76: fix linked list corruption

A flaw was found in the linux kernal wifi subsystem mt76txqschedulependingwcid and mt76txqschedulepending functions of the mt76 driver. Under certain conditions, scheduled wcid entries are left on a temporary on‑stack list, which may lead to linked‑list corruption and memory corruption, allowing ...

kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b548365 "mt76: mt7921: rely on...

kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b548365 "mt76: mt7921: rely on...