Cloudanix VulnDB

CVE-2026-68193

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux wireless USB adapters can crash the whole computer when the device receives normal network traffic, requiring a reboot to recover.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in mt7925_mac_tx_free when TXRX_NOTIFY event is processed on non-MMIO buses (USB) because queue_ops->tx_cleanup is NULL, causing kernel panic in the RX worker.

Why it matters to the business

Wireless USB devices using mt7925 trigger kernel crashes and system reboots, leading to loss of network connectivity and potential data loss until the system is restarted or the driver is fixed.

How an attack unfolds

An attacker with ability to send crafted 802.11 frames to a vulnerable mt7925 USB device causes the RX path to dispatch PKT_TYPE_TXRX_NOTIFY, which invokes the NULL tx_cleanup callback and crashes the kernel; the issue is local to the driver and does not require remote code execution.

How to fix it

Apply the upstream fix that gates TXRX_NOTIFY handling behind mt76_is_mmio(); rebuild and install a patched kernel for any distribution shipping mt7925 USB support.

How to confirm the fix worked

Confirm mt76_is_mmio() check is present before the mt7925_mac_tx_free call in mt7925_rx_check and mt7925_queue_rx_skb; boot a USB mt7925 device and verify no NULL dereference occurs on RX events.

Typical attack path

  1. Attacker transmits frames that elicit TXRX_NOTIFY responses on the target USB wifi adapter
  2. mt76u_rx_worker receives the packet and calls mt7925_rx_check
  3. mt7925_rx_check dispatches to mt7925_mac_tx_free without checking bus type
  4. mt7925_mac_tx_free calls NULL queue_ops->tx_cleanup pointer
  5. Kernel dereferences address 0x0 and panics

How to detect it

Search kernel logs and dmesg for the exact BUG line 'kernel NULL pointer dereference' followed by the call trace containing mt7925_mac_tx_free and mt76u_rx_worker; correlate with USB device enumeration of mt7925.

  • BUG: kernel NULL pointer dereference, address: 0000000000000000
  • RIP: 0010:0x0
  • mt7925_mac_tx_free+0x58/0x350 [mt7925_common]
  • mt7925_rx_check+0xe2/0x130 [mt7925_common]
  • mt76u_rx_worker+0x1b9/0x620 [mt76_usb]

What your security team should do

  • Prioritize kernel updates for systems using mt76 USB wifi adapters
  • Monitor kernel logs for mt7925_mac_tx_free NULL pointer oops until patched
  • Disable mt7925 USB devices or switch to MMIO-based hardware as a temporary workaround if updates are delayed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatch it to mt7925_mac_tx_free() on every bus. mt7925_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7925_mac_tx_free+0x58/0x350 [mt7925_common] mt7925_rx_check+0xe2/0x130 [mt7925_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

Affected packages

Ecosystem Package Introduced Fixed