SB20261023105 - NULL pointer dereference in Linux kernel mt76 mt7603 driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99060)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to missing initialization of the driver-private global station WCID in the Linux kernel's mt7603 wireless driver when queuing frames that have neither a station nor a virtual interface. A local privileged user can inject a frame through a monitor interface to make __skb_queue_tail() dereference a NULL prev pointer in an uninitialized sk_buff_head, causing a kernel fault.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/19d6fa087dcf242223645828b8282d4040bad168
• https://git.kernel.org/stable/c/456de496b53ae73e6e3020fec815dbdc88aa7c07
• https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff
• https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb
• https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6