CVE-2026-68194 - Vulnerability Details

- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and
mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus.
mt7921_mac_tx_free() cleans the DMA tx queues with
mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the
mmio queue ops implement that callback; on USB and SDIO it is NULL, so
a TXRX_NOTIFY there calls a NULL pointer in the RX worker:

BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Call Trace:
mt7921_mac_tx_free+0x64/0x310 [mt7921_common]
mt7921_rx_check+0x5f/0xf0 [mt7921_common]
mt76u_rx_worker+0x1b9/0x620 [mt76_usb]

Drop the event on non-mmio buses via mt76_is_mmio(), as in
commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for
non-mmio devices").

Published: 2026-08-10

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference occurs in the mt7921 wireless driver when a TXRX_NOTIFY event—valid only for MMIO buses—is dispatched on non-MMIO buses such as USB or SDIO. The driver attempts to clean DMA TX queues, calling a NULL callback, which results in a kernel panic. This leads to immediate system instability and loss of service.

Affected Systems

The flaw affects Linux kernels that include the mt76 driver for the mt7921 chipset when the device is connected via USB or SDIO. All kernel builds lacking commit 5683e1488aa9 or similar fixes are vulnerable. Specific kernel version numbers are not provided in the data.

Risk and Exploitability

The CVSS score is 4.8 and the EPSS score is below 1%, indicating a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who can influence traffic on the affected wireless interface could trigger the bogus TXRX_NOTIFY event, provoking a crash. The probable attack vector is inferred to be remote via manipulated wireless traffic, though local or privileged exploitation could also occur.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`48fab5bbef4092d925ab3214773ad12e68807223`	affected	< 7003a2cbddd7917933c1f169c7874cfa6ab852c3
`48fab5bbef4092d925ab3214773ad12e68807223`	affected	< ef2ee5f820c3ef87643b51e960c20b4a14d8336b
`48fab5bbef4092d925ab3214773ad12e68807223`	affected	< ecf995b828191829ba4a87169bccabcbeb5c9c32
`48fab5bbef4092d925ab3214773ad12e68807223`	affected	< 263816e92e8d66c81c98ccab2b5d2191ed08ec71
`48fab5bbef4092d925ab3214773ad12e68807223`	affected	< 24475d2ddc8d8dfd82f4d2be0d951401f86911a6
`48fab5bbef4092d925ab3214773ad12e68807223`	affected	< da4082e91acabc1498611ed8ccc53f0610baefc6

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[48fab5bbef4092d925ab3214773ad12e68807223,ef2ee5f820c3ef87643b51e960c20b4a14d8336b)`	affected	code_commit	—
`[48fab5bbef4092d925ab3214773ad12e68807223,ecf995b828191829ba4a87169bccabcbeb5c9c32)`	affected	code_commit	—
`[48fab5bbef4092d925ab3214773ad12e68807223,263816e92e8d66c81c98ccab2b5d2191ed08ec71)`	affected	code_commit	—
`[48fab5bbef4092d925ab3214773ad12e68807223,24475d2ddc8d8dfd82f4d2be0d951401f86911a6)`	affected	code_commit	—
`[48fab5bbef4092d925ab3214773ad12e68807223,da4082e91acabc1498611ed8ccc53f0610baefc6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.16`	affected	generic	—
`[0,5.16)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes commit 5683e1488aa9 or backport the patch to the mt7921 driver.
If the patch cannot be applied immediately, ensure the wireless device is attached via an MMIO bus or disable non-MMIO interfaces to prevent the crash.
If neither option is available, consider temporarily disabling the Wi‑Fi interface until the driver bug is resolved.

Generated by OpenCVE AI on August 13, 2026 at 07:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00205.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/24475d2ddc8d8dfd82f4d2be0d951401f86911a6
https://git.kernel.org/stable/c/263816e92e8d66c81c98ccab2b5d2191ed08ec71
https://git.kernel.org/stable/c/7003a2cbddd7917933c1f169c7874cfa6ab852c3
https://git.kernel.org/stable/c/da4082e91acabc1498611ed8ccc53f0610baefc6
https://git.kernel.org/stable/c/ecf995b828191829ba4a87169bccabcbeb5c9c32
https://git.kernel.org/stable/c/ef2ee5f820c3ef87643b51e960c20b4a14d8336b
https://nvd.nist.gov/vuln/detail/CVE-2026-68194
https://www.cve.org/CVERecord?id=CVE-2026-68194

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7003a2cbddd7917933c1f169c7874cfa6ab852c3

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68194 https://www.cve.org/CVERecord?id=CVE-2026-68194
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Mon, 10 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB and SDIO it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7921_mac_tx_free+0x64/0x310 [mt7921_common] mt7921_rx_check+0x5f/0xf0 [mt7921_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").
Title		wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24475d2ddc8d8dfd82f4d2be0d951401f86911a6 https://git.kernel.org/stable/c/263816e92e8d66c81c98ccab2b5d2191ed08ec71 https://git.kernel.org/stable/c/da4082e91acabc1498611ed8ccc53f0610baefc6 https://git.kernel.org/stable/c/ecf995b828191829ba4a87169bccabcbeb5c9c32 https://git.kernel.org/stable/c/ef2ee5f820c3ef87643b51e960c20b4a14d8336b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:12.245Z

Updated: 2026-08-19T16:31:09.017Z

Reserved: 2026-07-30T09:28:09.374Z

Link: CVE-2026-68194

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:06.783

Modified: 2026-08-19T17:20:35.577

Link: CVE-2026-68194

Redhat

Severity : Important

Publid Date: 2026-08-10T12:00:12Z

Links: CVE-2026-68194 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T07:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object