CVE-2026-68195: Linux Kernel mt76 Driver DoS Vulnerability

CVE-2026-68195 Overview

CVE-2026-68195 is a Linux kernel vulnerability in the mt76 wireless driver, specifically in the mt7615 chipset support code. The driver dispatches PKT_TYPE_TXRX_NOTIFY events to mt7615_mac_tx_free() regardless of the underlying bus type. On non-MMIO buses such as USB and SDIO used by mt7663 devices, the tx_cleanup queue operation callback is NULL, resulting in a NULL pointer dereference within the RX worker thread. The fix filters the event using mt76_is_mmio() so that only memory-mapped I/O devices process it.

Critical Impact
A NULL pointer dereference in the RX worker can crash the kernel on affected mt7663 USB and SDIO wireless devices when specific packet types are received.

Affected Products

Linux kernel mt76 wireless driver (mt7615 module)
mt7663 USB wireless adapters
mt7663 SDIO wireless adapters

Discovery Timeline

2026-08-10 - CVE-2026-68195 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68195

Vulnerability Analysis

The defect resides in the receive path of the MediaTek mt76 wireless driver. Two functions, mt7615_rx_check() and mt7615_queue_rx_skb(), forward the PKT_TYPE_TXRX_NOTIFY event to mt7615_mac_tx_free() on every supported bus. That handler invokes mt76_queue_tx_cleanup(), which calls the queue_ops->tx_cleanup() function pointer to reap the DMA transmit queues.

Only the MMIO queue operations implement the tx_cleanup callback. USB and SDIO queue operations leave the pointer as NULL. When a TXRX_NOTIFY event arrives on a mt7663 USB or SDIO device, the RX worker calls through a NULL function pointer and triggers a kernel oops. The same class of defect was previously addressed for the sibling mt7921 and mt7925 drivers.

Root Cause

The root cause is missing bus-type validation before dispatching an MMIO-only event to a shared handler. PKT_TYPE_TXRX_NOTIFY is documented as an MMIO-only event, yet the RX dispatch path treated it as bus-agnostic. This is a kernel-level NULL pointer dereference in a driver control flow.

Attack Vector

The trigger requires that an affected mt7663 USB or SDIO device receive frames that the firmware surfaces as PKT_TYPE_TXRX_NOTIFY. Because the event is generated by the device firmware and consumed in the kernel RX worker, exploitation prerequisites depend on wireless proximity or a malicious peer capable of eliciting the notification. The realized impact is a kernel crash, denial of service for the affected host, and potential loss of unsaved work.

The upstream fix drops the event on non-MMIO buses using the mt76_is_mmio() helper, mirroring the approach taken in commit 5683e1488aa9 which excluded WED status checks for non-MMIO devices. See the Kernel Commit 39afc46 and related backports for the exact code change.

Detection Methods for CVE-2026-68195

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing mt7615_mac_tx_free, mt76_queue_tx_cleanup, or NULL pointer dereference in the RX worker context.
Unexpected wireless interface resets or driver reload events on hosts using mt7663 USB or SDIO adapters.
Repeated crashes correlated with wireless traffic reception on affected hardware.

Detection Strategies

Inventory Linux hosts loading the mt7615e, mt7663u, or mt7663s kernel modules and cross-check kernel versions against fixed stable releases.
Parse kernel crash telemetry for stack traces containing mt76_queue_tx_cleanup on non-PCIe hardware.
Track kernel package versions across the fleet and flag systems that have not received the backported fix.

Monitoring Recommendations

Forward journalctl -k and /var/log/kern.log to a centralized log platform to alert on driver oops signatures.
Enable kdump on production Linux hosts to capture crash dumps for post-incident analysis.
Monitor wireless interface uptime metrics; frequent link drops on mt7663 USB or SDIO devices warrant inspection.

How to Mitigate CVE-2026-68195

Immediate Actions Required

Update to a Linux kernel that includes one of the fix commits referenced in the NVD entry.
On unpatched systems using mt7663 USB or SDIO adapters, unload the affected driver modules until the kernel is updated.
Where wireless connectivity is not required, disable the affected adapter in the system BIOS or via udev rules.

Patch Information

The fix is available in the following upstream commits: Kernel Commit 39afc46, Kernel Commit 88c98ef, Kernel Commit ab4d213, Kernel Commit b2ab73b, and Kernel Commit f2a72f4. Consult your distribution's advisories for the corresponding backported kernel package versions.

Workarounds

Blacklist the mt7663u and mt7663s kernel modules on hosts that do not require the affected hardware.
Replace mt7663 USB or SDIO adapters with MMIO-based wireless hardware where feasible.
Restrict physical and RF proximity to affected hosts to reduce the opportunity for a malicious peer to trigger the event.

bash

# Example: blacklist the affected USB and SDIO modules until patched
echo 'blacklist mt7663u' | sudo tee /etc/modprobe.d/mt7663-cve-2026-68195.conf
echo 'blacklist mt7663s' | sudo tee -a /etc/modprobe.d/mt7663-cve-2026-68195.conf
sudo update-initramfs -u
sudo reboot