CVE-2026-68308

What it actually does

Null pointer dereference in the mt76 mt7996 driver when mt76_connac_get_he_phy_cap returns NULL and the caller dereferences the pointer without a check, leading to a kernel crash or memory corruption.

Why it matters to the business

Wireless network interface instability or system crashes on affected Linux devices can interrupt connectivity-dependent operations and require unplanned reboots or driver reloads.

How an attack unfolds

An attacker with local or adjacent network access crafts specific 802.11 frames or driver configurations that cause mt76_connac_get_he_phy_cap to return NULL; the unchecked pointer is then dereferenced, triggering a kernel fault.

How to fix it

Apply the upstream kernel commit that adds the NULL check before dereferencing the pointer returned by mt76_connac_get_he_phy_cap; rebuild and deploy the patched kernel image on affected systems.

How to confirm the fix worked

Inspect the mt76/mt7996 driver source for the added NULL-pointer guard after the mt76_connac_get_he_phy_cap call; confirm the fixed kernel version is running via uname or package manager and test wireless association under HE-capable conditions.

Typical attack path

1. Gain local access or adjacent Wi-Fi presence on a system using the mt76 mt7996 driver
2. Trigger the code path that invokes mt76_connac_get_he_phy_cap under conditions that return NULL
3. Cause dereference of the NULL pointer to induce kernel panic or memory corruption
4. Leverage resulting instability for denial of service or attempt further privilege escalation via the crash handler

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic entries referencing mt76, mt7996, or mt76_connac_get_he_phy_cap; correlate with wireless interface initialization or HE capability negotiation events.

What your security team should do

• Prioritize kernel updates for any systems exposing the mt76 mt7996 driver to untrusted networks
• Monitor vendor or distribution advisories for backported fixes in supported LTS kernels
• Temporarily disable 802.11ax/HE features if a patch cannot be applied promptly
• Include kernel oops logs in routine crash-dump analysis pipelines