PT-2026-94714

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver where the mt7996 mcu beacon cntdwn function emits two bss bcn cntdwn tlv entries during an active CSA countdown, but the MT7996 BEACON UPDATE SIZE on...

PT-2026-94715

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the mt7996 driver where the mt7996 mac reset work function parks the tx worker and disables RX/TX NAPIs before acquiring the dev-mt76.mutex. Because mt76 worke...

PT-2026-94699

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver where the system fails to stop the attachment of wed hif2 for the secondary PCIe function if the primary WED attach fails. This results in an...

PT-2026-94724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver where an incorrect MLD ID field in the TXD Transmit Descriptor can cause a firmware busy loop when a third link is in power saving mode. This leads t...

PT-2026-94722

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver within the mt76 wifi module. The band idx value, derived from a 2-bit descriptor field ranging from 0 to 3, is used directly to index the dev-mt76.ph...

Linux Distros Unpatched Vulnerability : CVE-2026-80933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A...

Linux Distros Unpatched Vulnerability : CVE-2026-80934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC- TXP for AddBA req action frames MTTXD7MACTXD, set in...

AZL-100748 CVE-2026-80935 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

UBUNTU-CVE-2026-80934

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80935

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80934

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

PT-2026-90063

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the mt7996 driver where the default EEPROM firmware is parsed and copied without verifying its length. If a truncated file is used, the driver may read beyond the firmware...

CVE-2026-80632

A flaw was found in the Linux kernel's Wi-Fi driver, specifically within the mt7996 component. When the MT76NPU and CONFIGNETMEDIATEKSOCWED configurations are enabled and the Airoha NPU System-on-Chip SoC is detected, the mt7996inittxqueues function can attempt to dereference a NULL Wi-Fi/Etherne...

SUSE CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7996: Fixed a possible token leak in the mt7996txprepareskb function. If the linkconf or linksta lookups fail in the mt7996txprepareskb routine, the mt7996 driver may leak a previously allocated transmission token...

Linux Distros Unpatched Vulnerability : CVE-2026-74323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta...