EUVD-2026-55408

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

CVE-2026-68307 wifi: mt76: mt7925: fix crash in reset link replay

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

EUVD-2026-55294

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68193 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68193 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68193

The CVE-2026-68193 entry concerns the Linux kernel’s wifi mt76 mt7925 driver. A TXRX_NOTIFY event is mmio-only, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatched it to mt7925_mac_tx_free() on non-mmio buses, where tx cleanup called a NULL queue_ops->tx_cleanup() on USB. This caused a ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7925: Fixed possible out-of-band OOB access in mt7925macwritetxwi80211. Check the frame length before accessing the mgmt fields in mt7925macwritetxwi80211 in order to avoid possible OOB access...

CVE-2026-64325

A flaw was found in the Linux kernel's mt76 Wi-Fi driver, affecting mt7921 and mt7925 chipsets. When a channel-switch announcement CSA beacon is received, a timing issue can occur if a station disconnects before a queued work item processes the beacon. This can lead to a NULL pointer dereference ...

SUSE CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

UBUNTU-CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

EUVD-2026-48869

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel wifi mt76 driver (mt7921/mt7925), CVE-2026-64325 describes a NULL pointer dereference triggered when a CSA beacon is processed and the station disconnects before the queued work runs. The issue arises from dereferencing dev->new_ctx without a NULL check in mt7921_channel_sw...

CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

Linux Distros Unpatched Vulnerability : CVE-2026-64325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at...

PT-2026-64546

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the mt76 WiFi driver when processing a channel-switch announcement CSA beacon. When cfg80211 queues a wiphy work item that calls the functions mt7921...

SUSE CVE-2026-63832

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76staadd Since mt7925macstaadd publishes wcid, add publish check in mt76staadd to avoid reinitializing the wcid-polllist. Found dev-stapolllist corruption when using mt7925 and 7.1-rc4...