CVE-2026-68309

What it actually does

NULL pointer dereference in mt76_connac_mcu_uni_bss_he_tlv when mt76_connac_get_he_phy_cap returns NULL without a preceding check, leading to kernel memory corruption or panic.

Why it matters to the business

Unexpected system crashes or denial of service on Linux devices using MediaTek WiFi hardware, causing operational downtime and requiring restarts or maintenance.

How an attack unfolds

An attacker triggers the code path that invokes mt76_connac_get_he_phy_cap under conditions where it returns NULL, then relies on the subsequent dereference inside mt76_connac_mcu_uni_bss_he_tlv to induce a kernel fault.

How to fix it

Apply the upstream kernel patch that adds an explicit NULL check on the capability pointer before dereference in mt76_connac_mcu_uni_bss_he_tlv; rebuild and deploy updated kernels to affected systems.

How to confirm the fix worked

Inspect the mt76 source for the added NULL guard before pointer use; confirm the patch is present via kernel build logs or source tree comparison, then exercise HE BSS operations on MediaTek hardware without inducing faults.

Typical attack path

1. Locate a Linux system running a vulnerable mt76 driver version with MediaTek WiFi hardware
2. Send crafted 802.11 frames or trigger BSS/HE capability negotiation that reaches mt76_connac_mcu_uni_bss_he_tlv
3. Force mt76_connac_get_he_phy_cap to return NULL
4. Allow the unchecked dereference to occur, resulting in kernel oops or panic

How to detect it

Review kernel ring buffers and system logs for NULL pointer dereference faults or oops entries containing mt76_connac or mt76_connac_mcu_uni_bss_he_tlv references after wireless association events.

What your security team should do

• Prioritize kernel updates for any systems exposing MediaTek mt76 WiFi drivers
• Monitor kernel logs for oops or panic messages referencing mt76_connac_mcu_uni_bss_he_tlv
• Limit exposure by disabling unnecessary WiFi features or using alternative drivers where feasible until patched