SB20261023203 - Incorrect calculation in Linux kernel mediatek mt76 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-98958)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by blocking transmissions for an affected wireless station.

The vulnerability exists due to incorrect per-link accounting of non-AQL frames in the Linux kernel mt76 wireless driver when processing transmission completions for a multi-link operation (MLO) peer. A remote attacker on the local network can trigger traffic that is queued on one link but completed on another to cause counter increments and decrements to affect different link counters, potentially inflating the pending-frame count until further transmissions for the station are blocked.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40
• https://git.kernel.org/stable/c/9f28f504650869d41f7b3e98e4bc4547af4d5670
• https://git.kernel.org/stable/c/e0f2ae4a7539454ec50c353571779fcda8c0cfcf