Cloudanix VulnDB

CVE-2026-68311

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel driver for certain MediaTek WiFi chips can crash the entire system when handling multiple wireless links.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in mt7925_sta_set_decap_offload when mt792x_sta_to_link returns NULL for a valid vif link without a corresponding station link, allowing dereference of mlink->wcid without prior validation.

Why it matters to the business

Kernel panic or system crash on affected MediaTek mt7925 WiFi hardware under MLO configurations, causing loss of wireless connectivity and potential denial of service until reboot.

How an attack unfolds

An attacker with the ability to influence station link state on an MLO-enabled mt7925 interface triggers the decap offload update path; the missing guard allows NULL mlink dereference during WCID flag manipulation, leading to immediate kernel crash.

How to fix it

Apply the upstream kernel patch that adds a NULL check for the link STA before accessing mlink->wcid; rebuild and deploy updated kernel images containing the mt76 mt7925 fix.

How to confirm the fix worked

Confirm presence of the guard check in mt7925_sta_set_decap_offload source; verify kernel version includes the commit resolving the mt792x_sta_to_link NULL case; test MLO station association and decap offload updates without crash.

Typical attack path

  1. Establish MLO association where station lacks link STAs for all vif valid_links
  2. Trigger mt7925_sta_set_decap_offload via link state change or offload configuration
  3. Iterate valid_links mask and call mt792x_sta_to_link returning NULL
  4. Dereference NULL mlink->wcid before readiness check

How to detect it

Review kernel logs for NULL pointer dereference oops in mt7925 or mt76 decap offload paths; correlate with MLO station association events around crash timestamps.

What your security team should do

  • Prioritize kernel update for all systems using mt7925 hardware with MLO support
  • Monitor for related mt76 driver patches in distribution security advisories
  • Restrict MLO configuration on affected hardware until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925_sta_set_decap_offload() iterates over the vif valid_links mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of the vif, so mt792x_sta_to_link() can return NULL for a link that belongs to the vif but not to the station. The function currently dereferences mlink before checking whether the link WCID is ready. If mlink is NULL, setting or clearing MT_WCID_FLAG_HDR_TRANS dereferences a NULL pointer. Skip links without a station link before touching mlink->wcid.

Affected packages

Ecosystem Package Introduced Fixed