Cloudanix VulnDB

CVE-2026-98958

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Wi-Fi drivers can cause wireless connections using multiple radio links to stop working after normal use, requiring a software update to restore reliable operation.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect per-link accounting of non-AQL packets for MLO peers causes the non_aql_packets counter to increment on one wcid and decrement on another, leading to unbounded drift that eventually blocks the station from transmitting.

Why it matters to the business

Wi-Fi clients using multi-link operation may experience sudden, unexplained loss of connectivity or inability to transmit, degrading wireless network reliability in environments with modern 802.11be hardware.

How an attack unfolds

An attacker with a wireless client capable of MLO can send frames that the driver queues on one link but the hardware completes on another; repeated transmissions cause the peer-wide counter to drift until the station is blocked, producing a denial-of-service condition.

How to fix it

Update the mt76 driver to the version containing the fix that keeps the non_aql_packets count on the primary-link wcid; rebuild and deploy the updated kernel module or distribution package containing the corrected accounting logic.

How to confirm the fix worked

Confirm the presence of the upstream commit that moves non-AQL accounting to the primary-link wcid; verify that non_aql_packets no longer drifts under MLO traffic and that stations remain unblocked after sustained transmission on secondary links.

Typical attack path

  1. Associate an MLO-capable station to an mt76 AP
  2. Transmit data frames that the driver queues on the primary link
  3. Force or allow the hardware to complete those frames on a secondary link
  4. Repeat until the drifted non_aql_packets counter blocks the station

How to detect it

Review kernel logs and driver debug output for repeated increments of non_aql_packets without corresponding decrements on the same wcid, or for sudden station blocking events under MLO traffic patterns.

What your security team should do

  • Prioritize kernel updates containing the mt76 fix on all systems using MediaTek Wi-Fi 7 hardware with MLO enabled
  • Monitor upstream stable and distribution kernels for the patch within the next 30 days
  • Temporarily disable MLO on affected mt76 interfaces if immediate patching is not feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid->non_aql_packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware reports the completion on the link that it used for the transmission. This link can differ from the link that the driver queued the frame on. In that case, the increment and the decrement go to different link wcids, and the count drifts upwards until it blocks the station. Keep the count on the wcid of the primary link, like the other peer-wide state.

Affected packages

Ecosystem Package Introduced Fixed