CVE-2026-90374

A flaw was found in the Linux kernel's mt76 wifi driver. This vulnerability occurs due to improper validation of the bandidx field, which is used to index an array. A malicious actor could provide a corrupt or reserved descriptor value, leading to an out-of-bounds access or a NULL pointer...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace “skbPut” with “skbPutZero” Avoid potentially reusing uninitialized data...

PT-2026-94719

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the mt76 wifi driver during the recycling of RXDMAD C buffers. These buffers originate from RRO data queues' page pools and are bound to a different NAPI New...

PT-2026-94717

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the mt76 wifi driver. The functions mt76 mmio write copy and mt76 mmio read copy iterate up to an aligned length of four bytes. When the length is...

PT-2026-94716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7915 driver within the mt76 wifi subsystem. When the mt76 wcid alloc function fails, the mt7915 add interface function returns without clearing the vif mask and...

PT-2026-94698

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt76 wifi driver where the mt76 vif link function indexes the mvif-link array without validating the link id. When callers pass mvif-deflink id or msta-deflink id...

PT-2026-94725

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt76 wifi driver regarding RX data queuing for RRO 3.0. RX data released from a RRO data queue is incorrectly handled, leading to frames being left on the data que...

PT-2026-94697

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access exists in the mt7996 tx function within the mt76 wifi driver. When mac80211 leaves the link unspecified, the function uses a primary link id that may be set...

PT-2026-94722

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver within the mt76 wifi module. The band idx value, derived from a 2-bit descriptor field ranging from 0 to 3, is used directly to index the dev-mt76.ph...

AZL-100602 CVE-2026-80938 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork. mt7615macwork acquires the same mutex via mt7615mutexacquire at the top o...

AZL-100748 CVE-2026-80935 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80934

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80935

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

SUSE CVE-2026-74325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

PT-2026-82932

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996 init tx queues When MT76 NPU and CONFIG NET MEDIATEK SOC WED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996 init tx queues will dereference a NULL WED...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: Use kfreercu for the off-channel link in mt76putvifPhyLink. The mt76putvifPhyLink function frees the off-channel mlink using the plain kfree function, after calling rcuassignpointerNULL. However, rcuassignpointer only...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7996: Fixed a possible token leak in the mt7996txprepareskb function. If the linkconf or linksta lookups fail in the mt7996txprepareskb routine, the mt7996 driver may leak a previously allocated transmission token...

UBUNTU-CVE-2026-74323

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...

CVE-2026-68310

A flaw was found in the Linux kernel's mt76 wifi driver. This vulnerability arises from improper handling of High Efficiency HE capability lookups, where a null pointer could be dereferenced. This could lead to a system crash, resulting in a Denial of Service DoS. Mitigation To mitigate this issu...

CVE-2026-68306

In the Linux kernel, the wifi mt76 mt7996 driver vulnerability CVE-2026-68306 could cause a NULL pointer dereference in mt7996_mcu_sta_bfer_eht() if mt76_connac_get_eht_phy_cap() returns NULL. The advisory notes that the cap pointer must be checked before dereferencing it, and the issue has been ...