CVE-2026-68306

What it actually does

NULL pointer dereference in mt7996_mcu_sta_bfer_eht() when mt76_connac_get_eht_phy_cap returns NULL before pointer dereference in the mt76 WiFi driver.

Why it matters to the business

Potential kernel crashes or panics on systems using affected MediaTek WiFi hardware, leading to loss of wireless connectivity and possible system instability until patched.

How an attack unfolds

An attacker triggers the vulnerable code path by supplying EHT PHY capability structures that cause mt76_connac_get_eht_phy_cap to return NULL, resulting in an immediate dereference attempt inside the mt7996 MCU station beamformer handling routine.

How to fix it

Apply the upstream Linux kernel patch that adds the missing NULL check before dereferencing the capability pointer returned by mt76_connac_get_eht_phy_cap; rebuild and deploy updated kernel images for affected mt7996 hardware.

How to confirm the fix worked

Inspect the mt7996.c source for the added NULL guard around the mt76_connac_get_eht_phy_cap result inside mt7996_mcu_sta_bfer_eht; confirm the function no longer crashes under synthetic NULL return test cases.

Typical attack path

1. Establish association or trigger beamforming negotiation with mt7996 device
2. Craft 802.11be EHT capability information that forces mt76_connac_get_eht_phy_cap to return NULL
3. Execute mt7996_mcu_sta_bfer_eht path without NULL check
4. Kernel dereferences NULL pointer causing oops or panic

How to detect it

Search kernel logs for oops traces or panic messages referencing mt7996_mcu_sta_bfer_eht or mt76_connac_get_eht_phy_cap; examine wireless association logs around the time of any system instability.

What your security team should do

• Prioritize kernel updates for any systems exposing mt7996 wireless interfaces
• Monitor vendor firmware releases that incorporate the mt76 fix
• Test wireless functionality post-update to verify EHT beamforming paths remain operational