CVE-2026-63866: Linux Kernel mt76 Driver Vulnerability

CVE-2026-63866 Overview

CVE-2026-63866 affects the Linux kernel's mt76 wireless driver, specifically the MediaTek MT7996 WiFi chipset support. The vulnerability stems from a stale Wireless Client Identifier (WCID) pointer that is not cleared when a station link is deinitialized in the mt7996_mac_sta_deinit_link() routine. An attacker on the adjacent wireless network can trigger dangling pointer access, potentially leading to memory corruption or arbitrary code execution in kernel context. The upstream fix clears the WCID pointer when the station link is removed.

Critical Impact
An adjacent attacker on the same WiFi network can trigger kernel memory corruption, resulting in potential remote code execution, privilege escalation, or denial of service on affected Linux systems using MT7996-based wireless hardware.

Affected Products

Linux kernel builds including the mt76 wireless driver with MT7996 chipset support
MediaTek MT7996-based access points and wireless devices running vulnerable kernel versions
Downstream Linux distributions shipping the affected drivers/net/wireless/mediatek/mt76/mt7996 code

Discovery Timeline

2026-07-19 - CVE-2026-63866 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63866

Vulnerability Analysis

The vulnerability resides in the MediaTek mt7996 WiFi driver within the Linux kernel's mt76 subsystem. When a wireless station (STA) link is torn down through mt7996_mac_sta_deinit_link(), the driver fails to clear the associated Wireless Client Identifier (WCID) pointer. The WCID structure tracks per-station state used across the transmit and receive paths of the driver.

When the pointer is left populated after the underlying station link has been deinitialized, subsequent driver operations may dereference a stale reference. This condition is characteristic of a use-after-free scenario, where kernel code operates on memory whose lifecycle has already ended. The attack surface is exposed to devices within radio range, matching the adjacent network attack vector.

Exploitation would typically involve orchestrating station association and disassociation events to race the deinitialization path against ongoing packet processing. Successful exploitation can corrupt kernel memory, yielding impacts to confidentiality, integrity, and availability.

Root Cause

The root cause is a missing pointer sanitization step in mt7996_mac_sta_deinit_link(). The function did not reset the WCID pointer bound to the station link during teardown, leaving a dangling reference that later code paths could dereference.

Attack Vector

An attacker must be positioned on the same wireless network as the target (adjacent network). No authentication or user interaction is required. The attacker manipulates association state transitions with a vulnerable MT7996-based device to trigger the stale pointer condition. Refer to the upstream fix in Kernel Git Commit 455a486 for the exact code change.

No verified public exploit code is available. The vulnerability mechanism is documented in the mainline patch that adds explicit WCID pointer clearing during station link deinitialization.

Detection Methods for CVE-2026-63866

Indicators of Compromise

Unexpected kernel oops or panic messages in dmesg referencing mt7996, mt76, or WCID-related functions
Kernel Address Sanitizer (KASAN) reports flagging use-after-free reads or writes in mt7996_mac_sta_deinit_link or adjacent code paths
Repeated wireless client association and disassociation events from unknown or unauthorized devices in nearby radio range

Detection Strategies

Enable kernel logging with CONFIG_KASAN in test environments to surface memory safety violations in the mt76 driver
Monitor kernel ring buffer and syslog for WARN_ON, BUG, or Oops traces originating from drivers/net/wireless/mediatek/mt76
Correlate wireless association logs with kernel instability events on affected hardware

Monitoring Recommendations

Forward kernel logs from Linux-based access points and endpoints to a centralized logging platform for anomaly analysis
Track kernel version inventory across wireless infrastructure to identify unpatched MT7996 deployments
Alert on unexpected reboots or wireless subsystem restarts on MT7996-based devices

How to Mitigate CVE-2026-63866

Immediate Actions Required

Apply the upstream kernel patches referenced in the commits 455a486, 8897324, and c575459 and rebuild affected kernels
Update to a Linux distribution kernel that incorporates the fix for the mt7996_mac_sta_deinit_link() WCID clearing
Inventory all Linux systems and access points using MT7996-based WiFi hardware to prioritize patching

Patch Information

The fix clears the WCID pointer when removing a station link within mt7996_mac_sta_deinit_link(). The corrective commits are available at Kernel Git Commit 455a486, Kernel Git Commit 8897324, and Kernel Git Commit c575459. Rebuild the kernel or install a distribution package that includes these commits.

Workarounds

Disable the mt7996 kernel module on systems where MT7996 wireless is not required until the patch can be applied
Restrict physical and radio access to affected wireless devices by reducing transmit power or isolating them on segmented networks
Enforce strong wireless authentication such as WPA3 to limit which clients can associate and trigger the vulnerable code path

bash

# Temporarily blacklist the vulnerable module until patched
echo "blacklist mt7996e" | sudo tee /etc/modprobe.d/blacklist-mt7996.conf
sudo rmmod mt7996e || true
sudo update-initramfs -u