CVE-2026-68194: Linux Kernel Privilege Escalation Flaw

CVE-2026-68194 Overview

CVE-2026-68194 is a NULL pointer dereference in the Linux kernel's mt76 wireless driver for MediaTek MT7921 chipsets. The PKT_TYPE_TXRX_NOTIFY event is an MMIO-only event, yet mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. On USB and SDIO transports, the queue operations do not implement the tx_cleanup() callback, so processing this event invokes a NULL function pointer in the RX worker. The fix drops the event on non-MMIO buses using mt76_is_mmio().

Critical Impact
A crafted or mistimed PKT_TYPE_TXRX_NOTIFY event on USB or SDIO MT7921 wireless adapters triggers a kernel NULL pointer dereference in the RX worker, causing a kernel crash and denial of service.

Affected Products

Linux kernel builds including the mt76 driver with MT7921 support
MediaTek MT7921 wireless devices on USB transports (mt76_usb)
MediaTek MT7921 wireless devices on SDIO transports

Discovery Timeline

2026-08-10 - CVE-2026-68194 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68194

Vulnerability Analysis

The defect resides in the receive path of the MediaTek mt7921 wireless driver. The driver treats PKT_TYPE_TXRX_NOTIFY as a generic event and hands it to mt7921_mac_tx_free() regardless of which bus the device is attached to. mt7921_mac_tx_free() cleans DMA transmit queues by calling mt76_queue_tx_cleanup(), which in turn dereferences queue_ops->tx_cleanup(). Only the MMIO queue operations implement that callback. On USB and SDIO the pointer is NULL, resulting in an unconditional call through a NULL function pointer from the RX worker context.

Root Cause

The root cause is a missing bus-type check on an MMIO-only event path [Null Pointer Dereference]. PKT_TYPE_TXRX_NOTIFY is defined for MMIO devices, but mt7921_rx_check() and mt7921_queue_rx_skb() route it into shared cleanup code without validating the transport. The queue operation table for USB and SDIO omits tx_cleanup, leaving a NULL slot that the shared path calls without guard.

Attack Vector

The crash triggers when the RX worker (mt76u_rx_worker for USB) processes a frame that the firmware classifies as PKT_TYPE_TXRX_NOTIFY. Any condition that causes such an event to appear on USB or SDIO produces the following call chain and kernel panic:

BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Call Trace:
 mt7921_mac_tx_free+0x64/0x310 [mt7921_common]
 mt7921_rx_check+0x5f/0xf0 [mt7921_common]
 mt76u_rx_worker+0x1b9/0x620 [mt76_usb]

The result is a kernel-level denial of service on hosts using affected MT7921 USB or SDIO adapters. No verified proof-of-concept code is published; refer to the upstream commits for the exact code paths.

Detection Methods for CVE-2026-68194

Indicators of Compromise

Kernel oops or panic log entries citing mt7921_mac_tx_free, mt7921_rx_check, and mt76u_rx_worker in the call trace.
NULL pointer dereference at address 0000000000000000 originating from the mt7921_common or mt76_usb modules.
Unexpected wireless interface resets or system reboots on hosts with MT7921 USB or SDIO adapters.

Detection Strategies

Parse dmesg, journalctl -k, and /var/log/kern.log for oops signatures that combine mt7921_common and mt76_usb frames.
Inventory endpoints and embedded systems for MT7921 wireless hardware bound to USB or SDIO transports using lspci, lsusb, and modinfo mt7921u.
Correlate kernel crash telemetry with wireless driver load events to distinguish this issue from unrelated mt76 faults.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on stack traces containing mt7921_mac_tx_free+0x64/0x310.
Track kernel package versions across the fleet to confirm patched builds are deployed on Linux hosts with MediaTek Wi-Fi adapters.
Monitor uptime and unplanned reboot metrics on IoT, laptop, and embedded devices that use MT7921 USB or SDIO modules.

How to Mitigate CVE-2026-68194

Immediate Actions Required

Update the Linux kernel to a stable release that includes the upstream fix that gates PKT_TYPE_TXRX_NOTIFY on mt76_is_mmio().
On systems that cannot be patched immediately, avoid using MT7921 wireless adapters on USB or SDIO buses.
Restrict physical and administrative access to hosts running vulnerable kernels with affected wireless hardware.

Patch Information

The fix is committed to the Linux stable tree. Apply a kernel that contains one of the following commits: Linux Kernel Commit #24475d2, Linux Kernel Commit #263816e, Linux Kernel Commit #da4082e, Linux Kernel Commit #ecf995b, and Linux Kernel Commit #ef2ee5f. The change mirrors the pattern in prior commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

Workarounds

Blacklist the mt7921u and mt7921s modules on affected systems until a patched kernel is installed.
Move MT7921-based wireless functionality to MMIO (PCIe) adapters, which are not affected by this code path.
Disable or physically remove USB or SDIO MT7921 wireless dongles from production systems where a kernel update is not yet available.

bash

# Blacklist the vulnerable USB and SDIO variants until patched
echo 'blacklist mt7921u' | sudo tee /etc/modprobe.d/cve-2026-68194.conf
echo 'blacklist mt7921s' | sudo tee -a /etc/modprobe.d/cve-2026-68194.conf
sudo modprobe -r mt7921u mt7921s 2>/dev/null || true
sudo update-initramfs -u