SB20260812221 - NULL pointer dereference in Linux kernel mt76 mt7925 driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-68307)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt7925_vif_connect_iter() and mt76_connac_mcu_uni_add_dev() when replaying firmware state for links during reset recovery. A local user can trigger MLO link changes or timeout recovery conditions to cause a denial of service.

The issue occurs when the driver temporarily tracks a link whose mac80211 bss_conf is no longer present.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/89d03bda560d635f66d495f37b46a187fd4edfdf
• https://git.kernel.org/stable/c/95b0cf02731c74e073ef8937f5526bd4442a0326
• https://git.kernel.org/stable/c/bd8b2ec838184236c3fcbf738a926328836adf12
• https://git.kernel.org/stable/c/d9326796a378f80be5f9fd60983c62fdccdf2f0b