CVE-2026-63832: Linux Kernel Privilege Escalation Flaw

CVE-2026-63832 Overview

CVE-2026-63832 is a list corruption vulnerability in the Linux kernel mt76 WiFi driver affecting MediaTek MT7925 chipsets. The flaw occurs in mt76_sta_add because mt7925_mac_sta_add publishes the wireless client identifier (wcid) before mt76_sta_add reinitializes the wcid->poll_list. This reinitialization corrupts the shared dev->sta_poll_list, producing kernel messages showing prev->next pointing at itself. Attackers within wireless range can trigger the condition through station association activity, leading to kernel memory corruption and potential code execution.

Critical Impact
Adjacent-network attackers can corrupt kernel linked-list structures in the WiFi stack, causing denial of service or potential privilege escalation on systems using MediaTek MT7925 wireless hardware.

Affected Products

Linux kernel mt76 wireless driver framework
Linux kernel mt7925_common driver module
Systems using MediaTek MT7925 WiFi chipsets

Discovery Timeline

2026-07-19 - CVE-2026-63832 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63832

Vulnerability Analysis

The vulnerability resides in the mt76 WiFi driver, which supports multiple MediaTek wireless chipsets including the MT7925. The mt76_sta_add function calls INIT_LIST_HEAD on the wcid->poll_list field after chipset-specific initialization already registered the wcid structure with dev->sta_poll_list. Reinitializing the list head after publication severs the doubly linked list's integrity.

Kernel logs from the reported crash show the classic signature of list corruption: list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). The corruption occurs at mt76_wcid_add_poll+0x95/0xd0, reached through the receive path mt7925_rx_check and mt792x_poll_rx.

Root Cause

The root cause is an ordering bug between generic and chipset-specific station-add routines. mt7925_mac_sta_add publishes the wcid to sta_poll_list via mt76_wcid_add_poll during station addition. The generic mt76_sta_add then unconditionally reinitializes wcid->poll_list, effectively pointing the node's next and prev at itself while other list operations still reference it. The fix introduces a publish check in mt76_sta_add to skip reinitialization when the wcid is already published.

Attack Vector

An attacker within wireless range of a vulnerable device can influence station association and authentication flows to trigger the reinitialization race. The reported reproduction involves roaming between access points, where authentication to a new AP after disconnection drives the affected code path. Because the corruption occurs during mt76_dma_rx_poll processing of TX status frames, crafted or high-volume management traffic on nearby networks can accelerate the condition.

No public exploit code is available. Technical detail can be reviewed in the kernel patch 20b1269, kernel patch 3c49985, and kernel patch 55e014a.

Detection Methods for CVE-2026-63832

Indicators of Compromise

Kernel log entries containing list_add corruption with prev->next referencing the same address as prev.
Stack traces including mt76_wcid_add_poll, mt7925_mac_add_txs, mt7925_rx_check, mt76_dma_rx_poll, or mt792x_poll_rx.
Unexpected kernel panics or soft lockups on hosts using MediaTek MT7925 WiFi adapters, particularly during roaming.

Detection Strategies

Inventory Linux endpoints with MediaTek MT7925 hardware and correlate kernel versions against the fixed commits 20b1269, 3c49985, and 55e014a.
Parse dmesg and journalctl -k output for list-corruption signatures tied to mt76 symbols.
Monitor for repeated wireless disconnect and reauthentication cycles preceding kernel warnings.

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on list_add corruption or slab corruption strings originating from mt76.
Track WiFi driver module versions across the fleet as part of vulnerability management baselines.
Enable panic_on_warn in test environments to capture full context when the condition triggers.

How to Mitigate CVE-2026-63832

Immediate Actions Required

Update affected Linux systems to a kernel build that includes commits 20b126920a259df4d7dcae19fcfe2c57a74d6b2e, 3c499851753a24d2e148d4e9ca51764c0c51554e, or 55e014aaec650ede08b693ba59c8d0443f13f11c.
Identify all hosts using the mt76 and mt7925_common modules with lsmod and prioritize patching for laptops and IoT devices on untrusted wireless networks.
Restart affected systems after patching to ensure the new kernel and driver modules are loaded.

Patch Information

Upstream fixes are available in the mainline and stable Linux trees. Apply the referenced patches or upgrade to a distribution kernel that has backported them. Distributions shipping Linux 7.1-rc4 and earlier variants of the mt76 driver are affected until the publish check is present in mt76_sta_add.

Workarounds

Disable the mt76 and mt7925_common kernel modules on systems where wireless is not required using modprobe -r and blacklisting.
Restrict wireless clients to controlled SSIDs and disable automatic roaming where possible to reduce the frequency of station re-association.
Use a wired network connection until a patched kernel is deployed on affected hardware.

bash

# Blacklist the vulnerable modules until the system is patched
echo 'blacklist mt7925_common' | sudo tee /etc/modprobe.d/blacklist-mt7925.conf
echo 'blacklist mt76' | sudo tee -a /etc/modprobe.d/blacklist-mt7925.conf
sudo update-initramfs -u
sudo reboot