Cloudanix VulnDB

CVE-2026-68307

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain wireless network chips can cause computers to crash and lose network connection when the driver tries to recover from errors.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in mt76_connac_mcu_uni_add_dev when mt7925_vif_connect_iter replays firmware state for a stale link whose mac80211 bss_conf has been freed after MLO reconfiguration or MCU timeout recovery, resulting in kernel crash during mt7925_mac_reset_work.

Why it matters to the business

Wireless connectivity on affected devices becomes unavailable until reboot; repeated resets can cause prolonged outages for users relying on mt7925 hardware.

How an attack unfolds

An attacker induces repeated reset conditions (e.g., via RF interference, targeted disassociation, or MCU timeout triggers) that cause the driver bitmap to reference a link whose bss_conf has already been removed, leading to the NULL dereference during state replay.

How to fix it

Apply the upstream kernel patch that adds a check to skip missing bss_conf entries before replaying links in mt7925_vif_connect_iter; rebuild and deploy the updated kernel image on all systems using mt7925 hardware.

How to confirm the fix worked

Confirm the patch is present by inspecting the mt7925_vif_connect_iter function for the added bss_conf NULL check; reproduce reset scenarios in a test environment and verify absence of the original crash call trace in dmesg.

Typical attack path

  1. Trigger conditions that force firmware reset or MLO link change on mt7925 interface
  2. Cause mac80211 to remove bss_conf for a link still present in mvif->valid_links bitmap
  3. Invoke mt7925_mac_reset_work which calls mt7925_vif_connect_iter
  4. mt7925_vif_connect_iter passes NULL bss_conf to mt76_connac_mcu_uni_add_dev
  5. Kernel crashes on NULL dereference

How to detect it

Search kernel logs (dmesg, journalctl) and crash dumps for the call trace containing mt76_connac_mcu_uni_add_dev+0x8c and mt7925_vif_connect_iter+0x9c during reset recovery; correlate with mt7925_mac_reset_work entries.

  • mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib]
  • mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common]
  • mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common]
  • x1 : 0000000000000000

What your security team should do

  • Prioritize kernel update for any systems containing mt7925 wireless hardware
  • Monitor kernel logs for the mt76_connac_mcu_uni_add_dev NULL dereference signature
  • Test wireless reset recovery in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links. After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily contain a link whose mac80211 bss_conf has already gone away. This can pass a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), matching the crash where x1, the second argument, is NULL: pc : mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] lr : mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] x2 : ffffff80a77f6018 x1 : 0000000000000000 x0 : ffffff8099402080 Call trace: mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common] Skip missing bss_conf entries before replaying the link. Non-MLO AP/STA reset replay is unchanged because the helper still returns &vif->bss_conf for the legacy link.

Affected packages

Ecosystem Package Introduced Fixed