Cloudanix VulnDB

CVE-2026-99060

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain wireless network drivers can crash the system when special test packets are sent through a monitoring mode, potentially knocking devices offline until restarted.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized driver-private global station WCID causes NULL prev pointer dereference in __skb_queue_tail when mt76_tx processes the first injected frame from a monitor interface after the tx_pending queue linkage change.

Why it matters to the business

Kernel crash or reset on affected wireless devices can interrupt connectivity, cause service outages, and require manual recovery, increasing operational overhead for organizations relying on mt7603-based hardware.

How an attack unfolds

An attacker with local access to a monitor interface injects wildcard probe requests; the frames reach mt76_tx which queues them onto the uninitialized WCID tx queue, dereferencing a NULL pointer and triggering an oops.

How to fix it

Apply the upstream fix that calls mt76_wcid_init on the driver-private global WCID before publishing it; rebuild and deploy the patched kernel on all affected mt7603 systems.

How to confirm the fix worked

Confirm the mt76_wcid_init call exists before mt76_register_device publishes the WCID; re-test by injecting three wildcard probe requests through a monitor interface and verifying no oops or queue corruption occurs.

Typical attack path

  1. Obtain local access or compromise a process with monitor interface privileges
  2. Inject frames (e.g., probe requests) via the monitor interface
  3. Trigger mt76_tx path that links the frame to the global WCID tx_pending queue
  4. Hit uninitialized sk_buff_head causing NULL dereference and kernel fault

How to detect it

Search kernel logs and dmesg for mt76 oops or reset messages immediately following monitor interface frame injection attempts; correlate with process activity creating monitor interfaces.

  • mt76 oops
  • uninitialized sk_buff_head
  • __skb_queue_tail NULL prev
  • mt7603 monitor interface injection

What your security team should do

  • Prioritize kernel update on all mt7603 devices within the next maintenance window due to recent publication
  • Restrict monitor interface access to trusted processes only
  • Monitor kernel logs for mt76-related oops entries until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer. Initialize the WCID before publishing it. The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.

Affected packages

Ecosystem Package Introduced Fixed