Cloudanix VulnDB

CVE-2026-68194

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain wireless network drivers can cause computers to crash unexpectedly when using USB or SDIO connections.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability causes a NULL pointer dereference in mt7921_mac_tx_free when handling PKT_TYPE_TXRX_NOTIFY events on non-MMIO buses like USB and SDIO, as the tx_cleanup callback is not implemented.

Why it matters to the business

Devices using the affected WiFi chipsets over USB or SDIO may experience kernel crashes and system instability when receiving certain wireless frames.

How an attack unfolds

An attacker sends crafted wireless packets that trigger the TXRX_NOTIFY event path in the mt7921 driver on USB or SDIO interfaces, leading to the NULL function call.

How to fix it

Apply the kernel patch that checks mt76_is_mmio before dispatching TXRX_NOTIFY events, or update to a kernel version containing the fix.

How to confirm the fix worked

Verify the presence of the mt76_is_mmio check in mt7921_rx_check and mt7921_queue_rx_skb functions in the source code.

Typical attack path

  1. Connect to a WiFi network using mt7921 over USB/SDIO
  2. Send specially crafted 802.11 frames
  3. Trigger RX worker processing of TXRX_NOTIFY
  4. Cause NULL pointer dereference and kernel panic

How to detect it

Search system logs for kernel NULL pointer dereference traces mentioning mt7921_mac_tx_free, mt7921_rx_check, or mt76u_rx_worker.

  • mt7921_mac_tx_free+0x64/0x310
  • mt7921_rx_check+0x5f/0xf0
  • BUG: kernel NULL pointer dereference
  • mt76u_rx_worker

What your security team should do

  • Prioritize patching systems with mt7921 USB/SDIO WiFi
  • Monitor for kernel oops involving mt7921
  • Consider disabling affected wireless hardware if unpatched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB and SDIO it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7921_mac_tx_free+0x64/0x310 [mt7921_common] mt7921_rx_check+0x5f/0xf0 [mt7921_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

Affected packages

Ecosystem Package Introduced Fixed