CVE-2026-99060 - Vulnerability Details

- wifi: mt76: mt7603: initialize global station WCID

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7603: initialize global station WCID

mt7603 uses a driver-private global station WCID for frames that have
neither a station nor a vif, including frames injected through a monitor
interface. Unlike the core global WCID initialized by
mt76_register_device(), this WCID is published without ever being passed
to mt76_wcid_init().

Since commit 0335c034e726 ("wifi: mt76: fix race condition related to
checking tx queue fill status"), mt76_tx() queues every such frame on the
WCID's tx_pending or tx_offchannel queue and links its tx_list. The first
injected frame therefore reaches __skb_queue_tail() with an uninitialized
sk_buff_head and dereferences a NULL prev pointer.

Initialize the WCID before publishing it.

The fix was tested on an MT7603 PCIe device. Three wildcard probe requests
were injected through a monitor interface. The hardware queue head and tail
advanced from 0 to 3 and a second radio captured the third request over the
air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer
also completed without a reset.

Published: 2026-10-23

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw arises from the mt76 driver for MT7603 devices initializing a global station WCID without fully setting its internal queue pointers. When a frame that carries no station or vif reference is injected on a monitor interface, the driver enqueues it using the uninitialized WCID, causing a null pointer dereference in __skb_queue_tail. This results in a kernel oops that brings the system down, giving an attacker a convenient local denial‑of‑service vector. The weakness is a null‑pointer dereference (CWE‑476).

Affected Systems

All Linux kernel releases that ship the mt76 driver before commit 0335c034e726 are affected. The issue is specific to the MT7603 chipset, widely found in Wi‑Fi adapters and embedded routers. Any Linux system that enables monitor mode on such hardware can be targeted by an attacker who can inject raw frames, making the vulnerability particularly relevant for corporate or home routers that use this chipset.

Risk and Exploitability

The CVSS score of 4.4 denotes moderate severity, while the EPSS score of <1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local control of the monitor interface or possession of a device with monitor mode capabilities; thus it is a local denial‑of‑service risk rather than a remote code execution threat. Given the low EPSS, the likelihood of this flaw being abused currently is limited.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d2defcddfe90b3be0cfccc2482495ab1fb759586`	affected	< 99b8bd6323e6fc69615af828522878b7acb77bff
`0335c034e7265d36d956e806f33202c94a8a9860`	affected	< e454ec553996f21085657c96c8a605e2d89a81a6
`0335c034e7265d36d956e806f33202c94a8a9860`	affected	< dd117d17e8aa2e89f857fb708e5b770709fb81cb
`0335c034e7265d36d956e806f33202c94a8a9860`	affected	< 19d6fa087dcf242223645828b8282d4040bad168
`0335c034e7265d36d956e806f33202c94a8a9860`	affected	< 456de496b53ae73e6e3020fec815dbdc88aa7c07
`6.6.48`	affected	< 6.6.160

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[d2defcddfe90b3be0cfccc2482495ab1fb759586,99b8bd6323e6fc69615af828522878b7acb77bff)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,e454ec553996f21085657c96c8a605e2d89a81a6)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,dd117d17e8aa2e89f857fb708e5b770709fb81cb)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,19d6fa087dcf242223645828b8282d4040bad168)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,456de496b53ae73e6e3020fec815dbdc88aa7c07)`	affected	code_commit	—
`[6.6.48,6.6.160)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`6.7`	affected	semver	—
`[0,6.7)`	unaffected	generic	—
`[6.6.160,7.0.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[d2defcddfe90b3be0cfccc2482495ab1fb759586,99b8bd6323e6fc69615af828522878b7acb77bff)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,e454ec553996f21085657c96c8a605e2d89a81a6)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,dd117d17e8aa2e89f857fb708e5b770709fb81cb)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,19d6fa087dcf242223645828b8282d4040bad168)`	affected	code_commit	—
`[0335c034e7265d36d956e806f33202c94a8a9860,456de496b53ae73e6e3020fec815dbdc88aa7c07)`	affected	code_commit	—
`[6.6.48,6.6.160)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`6.7`	affected	semver	—
`[0,6.7)`	unaffected	generic	—
`[6.6.160,7.0.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a kernel or mt76 driver that includes commit 0335c034e726 or later, which initializes the WCID before publishing it.
If an update is unavailable, disable monitor mode on the MT7603 device to prevent injection of frames without a station or vif reference.
For embedded devices where the driver is shipped pre‑commit, replace the driver binary or apply the upstream patch from the Linux kernel source to properly initialize the WCID.

Generated by OpenCVE AI on October 27, 2026 at 22:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99060.mbox
https://git.kernel.org/stable/c/19d6fa087dcf242223645828b8282d4040bad168
https://git.kernel.org/stable/c/456de496b53ae73e6e3020fec815dbdc88aa7c07
https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff
https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb
https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6
https://nvd.nist.gov/vuln/detail/CVE-2026-99060
https://www.cve.org/CVERecord?id=CVE-2026-99060

History

Tue, 27 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Tue, 27 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99060.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99060 https://www.cve.org/CVERecord?id=CVE-2026-99060
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-476

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer. Initialize the WCID before publishing it. The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.
Title		wifi: mt76: mt7603: initialize global station WCID
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19d6fa087dcf242223645828b8282d4040bad168 https://git.kernel.org/stable/c/456de496b53ae73e6e3020fec815dbdc88aa7c07 https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:22:49.164Z

Updated: 2026-10-23T12:22:49.164Z

Reserved: 2026-09-25T10:25:14.388Z

Link: CVE-2026-99060

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:29.753

Modified: 2026-10-23T13:17:29.753

Link: CVE-2026-99060

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99060 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T22:30:10Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object