PT-2026-94718

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 mcu get chip config function within the mt76 wifi driver. The response Type-Length-Value TLV loop advances by the tlv-len value without a minimum threshold,...

CVE-2026-68306 wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

Mediatek wireless MT76 MCU Function Heap Overflow DoS

The vulnerability of the mt7996mcuexit function in the drivers/net/wireless/mediatek/mt76/mt7996/mcu.c file of the Mediatek wireless communication adapter driver in the Linux operating system is related to the failure to release resources after their useful life has ended. Exploiting this...

CVE-2023-54191

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix memory leak in mt7996mcuexit Always purge mcu skb queues in mt7996mcuexit routine even if mt7996firmwarestate fails...

PT-2024-32761

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description A issue has been resolved in the Linux kernel related to the wifi: mt76: mt7996 module. The chainmask is u16, and using hweight8 cannot get the correct tx ant. Without the patch, the tx ant of...

PT-2024-32736

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description A NULL pointer dereference issue has been identified in the mt7996 mcu sta bfer he routine when adding an sta interface to the mt7996 driver. This issue was found through a code review. The...