Cloudanix VulnDB

CVE-2026-68310

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain wireless chips could make the computer crash when setting up fast Wi-Fi connections.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() after mt76_connac_get_he_phy_cap() returns NULL for unmatched vif types during HE capability setup.

Why it matters to the business

Wireless driver instability or kernel crashes on affected MediaTek hardware can interrupt network connectivity and require system restarts, affecting uptime in environments relying on those chipsets.

How an attack unfolds

An attacker triggers the vulnerable code paths by presenting a wireless configuration or vif type that causes the capability lookup to fail and return NULL, which is then dereferenced without a guard.

How to fix it

Apply the kernel patch that fetches the capability before TLV append and skips HE setup on NULL; upgrade to a kernel containing the fix for mt76 mt7915 HE capability guarding.

How to confirm the fix worked

Confirm the patch is present by inspecting the mt7915_mcu.c source for the added NULL check before capability usage; test wireless association with varied vif types to ensure no crash occurs.

Typical attack path

  1. Establish or manipulate a wireless interface or BSS association that exercises HE TLV construction
  2. Force mt76_connac_get_he_phy_cap() to return NULL by using an unmatched vif type
  3. Execute the dereference in mt7915_mcu_bss_he_tlv() or mt7915_mcu_sta_bfer_tlv()

How to detect it

Review kernel logs for NULL pointer dereference oops involving mt7915_mcu_bss_he_tlv or mt76_connac_get_he_phy_cap; look for wireless stack crashes during BSS or station setup.

What your security team should do

  • Prioritize kernel updates on systems using mt76/mt7915 wireless drivers
  • Monitor for wireless driver oops or kernel panics in system logs
  • Disable HE features if patching is delayed and hardware supports it

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: guard HE capability lookups mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() both run after checking HE support, then dereference the HE PHY capability returned by mt76_connac_get_he_phy_cap(). That helper can return NULL when no capability entry matches the vif type. Fetch the capability before appending the TLV and skip the HE-specific setup when no matching capability is available.

Affected packages

Ecosystem Package Introduced Fixed