CVE-2026-68193 Overview
CVE-2026-68193 is a NULL pointer dereference vulnerability in the Linux kernel's mt76 wireless driver, specifically affecting the mt7925 chipset support code. The flaw resides in the receive path handling of PKT_TYPE_TXRX_NOTIFY events, which are only valid on memory-mapped I/O (MMIO) buses but are incorrectly dispatched across all bus types, including USB and SDIO.
When a TXRX_NOTIFY event arrives on a non-MMIO bus, the driver calls mt7925_mac_tx_free(), which invokes queue_ops->tx_cleanup(). This callback is only implemented for MMIO queue operations, so on USB it is NULL, triggering a kernel NULL pointer dereference inside the RX worker.
Critical Impact
A malformed or unexpected receive event on USB-connected mt7925 Wi-Fi adapters causes a kernel NULL pointer dereference and system crash (denial of service).
Affected Products
- Linux kernel builds including the mt76 driver with mt7925 support
- Systems using MediaTek MT7925 Wi-Fi adapters over USB or non-MMIO buses
- Distributions shipping vulnerable versions of mt7925_common and mt76_usb modules
Discovery Timeline
- 2026-08-10 - CVE-2026-68193 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68193
Vulnerability Analysis
The vulnerability affects the receive processing pipeline of the mt7925 Wi-Fi driver. The functions mt7925_rx_check() and mt7925_queue_rx_skb() classify incoming packets and route PKT_TYPE_TXRX_NOTIFY events to mt7925_mac_tx_free() without checking the underlying bus type.
mt7925_mac_tx_free() cleans DMA transmit queues via mt76_queue_tx_cleanup(), which dereferences the queue_ops->tx_cleanup function pointer. Only the MMIO queue operations structure populates this callback. USB and other non-MMIO bus back-ends leave it as NULL.
When the RX worker (mt76u_rx_worker) processes a TXRX_NOTIFY event on a USB device, the call chain reaches the NULL function pointer and the kernel oopses. The reported stack trace shows the fault at RIP: 0010:0x0 with the following call path:
- mt76u_rx_worker+0x1b9/0x620 [mt76_usb]
- mt7925_rx_check+0xe2/0x130 [mt7925_common]
- mt7925_mac_tx_free+0x58/0x350 [mt7925_common]
Root Cause
The root cause is missing bus-type validation before dispatching an MMIO-only event type to a handler that assumes MMIO-only data structures. The driver treats PKT_TYPE_TXRX_NOTIFY as universal when it is architecturally restricted to MMIO transports.
Attack Vector
Exploitation requires a TXRX_NOTIFY event to be delivered to the driver over a non-MMIO bus. This can occur through malformed firmware responses or crafted RX descriptors on a USB-attached mt7925 device. The result is a kernel crash and denial of service on the affected host.
The vulnerability manifests in the RX worker path. See the referenced kernel commits for the exact code paths and fix logic.
Detection Methods for CVE-2026-68193
Indicators of Compromise
- Kernel oops messages containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0
- Stack traces referencing mt7925_mac_tx_free, mt7925_rx_check, and mt76u_rx_worker
- Unexpected system crashes or hangs on hosts using MediaTek MT7925 USB Wi-Fi adapters
Detection Strategies
- Inventory Linux endpoints running the mt76_usb and mt7925_common modules with lsmod and correlate against kernel version
- Parse dmesg and /var/log/kern.log for the specific NULL dereference signature above
- Track kernel panic and oops events centrally to identify repeated crashes tied to the wireless subsystem
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on mt7925 or mt76u_rx_worker fault signatures
- Monitor host uptime and unexpected reboots on fleets using MediaTek Wi-Fi hardware
- Track kernel package versions across managed Linux systems to confirm patch adoption
How to Mitigate CVE-2026-68193
Immediate Actions Required
- Apply the upstream kernel fix that drops TXRX_NOTIFY events on non-MMIO buses using mt76_is_mmio()
- Update to a Linux kernel release that includes the referenced stable commits for the mt76/mt7925 driver
- Prioritize patching on laptops and embedded systems using MT7925 USB Wi-Fi modules
Patch Information
The fix drops PKT_TYPE_TXRX_NOTIFY events on non-MMIO buses by gating dispatch on mt76_is_mmio(), mirroring the approach in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices"). Reference the following stable tree commits: Kernel Git Commit 0c8c4cd, Kernel Git Commit 9677e86, Kernel Git Commit 9cb72f67, and Kernel Git Commit feeff151.
Workarounds
- Unload the mt7925u and mt76_usb modules on hosts that do not require MT7925 USB Wi-Fi until patches are applied
- Disable or physically remove affected USB Wi-Fi adapters where connectivity is not required
- Switch to MMIO-attached (PCIe) MT7925 hardware where feasible, as the vulnerable code path is not reached on MMIO buses
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
