CVE-2026-63832

What it actually does

This is a Linux kernel memory-corruption flaw in the mt76 Wi-Fi driver path used by MediaTek wireless chipsets, specifically around station/WCID handling in mt76_sta_add and mt7925-related receive/transmit-status processing. The bug can reinitialize an already-published wcid->poll_list, corrupting kernel linked-list state. Because the vulnerable code runs in kernel context, successful exploitation could cause a kernel crash or, in a worst case, allow attacker-controlled memory corruption with kernel-level confidentiality, integrity, and availability impact. The CVSS vector indicates adjacent-network exploitation with no privileges or user interaction required, meaning the attacker must generally be within Wi-Fi/radio range rather than remote over the internet.

Why it matters to the business

Systems using affected Linux kernels with vulnerable mt76/mt7925 Wi-Fi driver code may be exposed to attacks from nearby wireless attackers. The most likely operational impact is device instability, kernel panic, loss of wireless connectivity, or denial of service on laptops, embedded devices, kiosks, appliances, or edge systems that rely on affected MediaTek Wi-Fi hardware. Because the flaw is in kernel-space code and is rated high severity, organizations should treat it as a priority for mobile, workstation, and embedded Linux fleets even though there is currently no known KEV listing, no ransomware association, and no public exploit maturity reported. The low EPSS score suggests broad exploitation is not currently expected, but adjacent wireless attack surface can be difficult to monitor and may be relevant in public, office, retail, or hostile physical environments.

How an attack unfolds

An attacker positioned within wireless range targets a Linux system using an affected mt76-based MediaTek Wi-Fi device. The attacker sets up or manipulates nearby 802.11 network activity so the victim device authenticates, reconnects, roams, or processes crafted receive/transmit-status events that drive the mt7925 and mt76 station-add paths. In the vulnerable kernel, the driver can publish a WCID and later reinitialize its poll_list without the required publish-state check. That corrupts the kernel linked-list structure used by the driver, producing list_add corruption and potentially causing a kernel crash. Depending on kernel hardening, timing, hardware state, and attacker control over surrounding heap contents, the same corruption primitive could potentially be developed into stronger kernel memory corruption, though no public exploit is currently reported.

How to fix it

Apply a Linux kernel update that includes the upstream fix adding the WCID publish check in mt76_sta_add. Because no exact fixed package versions were provided, organizations should consult their Linux distribution, device vendor, or kernel supplier advisories for patched kernel builds containing the mt76 fix for this issue. Prioritize systems with MediaTek mt76/mt7925 Wi-Fi hardware, especially laptops, mobile workstations, embedded Linux devices, and systems used in untrusted wireless environments. If immediate patching is not possible, reduce exposure by disabling affected Wi-Fi interfaces, unloading the affected modules where operationally feasible, using wired networking, restricting use in untrusted wireless areas, and enabling kernel lockdown/hardening features where supported. Reboots are typically required after kernel updates to load the fixed kernel and driver modules.

How to confirm the fix worked

Confirm remediation by verifying that each system is running a patched kernel from the relevant vendor or distribution and that the loaded mt76-related modules correspond to the updated kernel package. Check hardware exposure with commands such as lspci, lsusb, lshw, or vendor inventory tooling to identify MediaTek Wi-Fi adapters using mt76/mt7925 drivers. Confirm loaded modules with lsmod or modinfo for mt76, mt76_connac_lib, mt792x_lib, mt7925_common, and related drivers. Review the distribution changelog, kernel package changelog, or source patch history for the mt76_sta_add WCID publish-check fix. After patching, reboot and confirm uname -a reports the expected fixed kernel. For mitigation validation, verify affected wireless interfaces are disabled or affected modules are not loaded.

Typical attack path

1. Identify Linux targets within Wi-Fi range that use MediaTek mt76/mt7925 wireless hardware and a vulnerable kernel build.
2. Create or manipulate nearby wireless network conditions, such as rogue access points, reassociation/roaming events, or crafted 802.11 traffic, to trigger station/WCID handling in the mt76 driver.
3. Cause the vulnerable mt76_sta_add and mt7925 processing path to reinitialize an already-published WCID poll list.
4. Trigger kernel list corruption in the mt76/mt7925 driver path.
5. Achieve denial of service through wireless driver failure or kernel panic; in a more advanced scenario, attempt to shape the memory corruption for kernel-level code execution or privilege impact.

How to detect it

To assess possible prior exploitation, collect kernel logs, system journal entries, crash dumps, and wireless subsystem logs from systems with mt76/mt7925 hardware. Focus on messages indicating linked-list corruption, slab corruption, kernel oops/panic, mt76 or mt7925 stack traces, and repeated Wi-Fi authentication, reassociation, or disconnect activity immediately before a crash. Useful sources include journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, dmesg archives, pstore/ramoops, kdump/vmcore artifacts, EDR kernel panic telemetry, NetworkManager or wpa_supplicant logs, and wireless AP/controller logs showing suspicious deauthentication, roaming, rogue AP, or authentication patterns. There are no known public attacker infrastructure indicators for this vulnerability; detection should therefore rely on host crash artifacts, driver stack traces, and correlation with nearby wireless activity.

• list_add corruption. prev->next should be next
• dev->sta_poll_list corruption
• mt76_wcid_add_poll
• mt76_sta_add
• mt7925_mac_sta_add
• mt7925_mac_add_txs
• mt7925_rx_check
• mt76_dma_rx_poll
• mt792x_poll_rx
• [mt76]
• [mt7925_common]
• [mt792x_lib]
• wlan0: disconnect from AP
• wlan0: authenticate with
• wlan0: send auth to
• slab kmalloc-8k start
• kernel BUG at lib/list_debug.c
• kernel panic
• Oops:
• BUG: unable to handle kernel
• mt76
• mt7925_common
• mt792x_lib

What your security team should do

• Prioritize patching Linux endpoints and embedded systems with MediaTek mt76/mt7925 Wi-Fi hardware, especially devices operating in public or untrusted wireless environments.
• Inventory systems for affected wireless drivers and chipsets using endpoint management, kernel module telemetry, lspci/lsusb data, or EDR asset attributes.
• Monitor kernel logs for mt76, mt7925, list_add corruption, wlan authentication/reassociation activity, kernel oops, panic, or slab corruption messages.
• Where patching is delayed, temporarily disable affected Wi-Fi interfaces or require wired networking for high-risk systems.
• Ask Linux distribution and device vendors for fixed kernel package versions if they are not yet documented in internal patch catalogs.
• Treat unexpected kernel crashes on systems with MediaTek Wi-Fi hardware as potentially security-relevant until logs and physical/wireless context are reviewed.
• Because this issue is not currently in CISA KEV and has low EPSS, balance urgency against exposure: prioritize adjacent-wireless exposed devices over servers without affected Wi-Fi hardware.