SB20260812225 - NULL pointer dereference in Linux kernel mt76 mt7925 driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-68311)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_sta_set_decap_offload() in the mt76 mt7925 wireless driver when updating decap offload state for an MLO station. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs when a vif valid_links entry does not have a corresponding link STA for the station.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1e608cae1ba0b4a600b752efa223fd2be376b143
• https://git.kernel.org/stable/c/96ea44f2269f30364cffa054ee3a87e595bef0d4
• https://git.kernel.org/stable/c/d86883f7e8f03a5b81b4e59f2c0b6c05f79e01fd
• https://git.kernel.org/stable/c/f1ee53e08fdd2906e90c6a6d71e1368fcd52bfc3