CVE-2026-68306: Linux Kernel mt76 Use-After-Free Flaw

CVE-2026-68306 Overview

CVE-2026-68306 is a NULL pointer dereference vulnerability in the Linux kernel's mt76 wireless driver, specifically in the MediaTek MT7996 chipset support code. The flaw resides in the mt7996_mcu_sta_bfer_eht() function, which invokes mt76_connac_get_eht_phy_cap() and dereferences the returned pointer without validating it. Because mt76_connac_get_eht_phy_cap() can theoretically return NULL, the caller may dereference an invalid pointer and trigger a kernel oops.

Critical Impact
A NULL pointer dereference in the Wi-Fi beamforming path can crash the kernel, resulting in denial of service on affected systems using MediaTek MT7996-based hardware.

Affected Products

Linux kernel branches shipping the mt76 driver with MT7996 support
Systems using MediaTek MT7996 Wi-Fi 7 chipsets with EHT (Extremely High Throughput) enabled
Distributions tracking mainline and stable Linux kernel trees prior to the referenced fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68306 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68306

Vulnerability Analysis

The vulnerability exists in the mt7996_mcu_sta_bfer_eht() routine within the drivers/net/wireless/mediatek/mt76/mt7996/ subsystem. This function constructs beamformer configuration messages sent to the MCU (Microcontroller Unit) firmware for stations that support EHT, the physical layer feature set introduced with Wi-Fi 7 (IEEE 802.11be).

During configuration, the function calls mt76_connac_get_eht_phy_cap() to obtain the EHT physical layer capability structure for the peer station. The helper can return NULL under specific conditions where the requested capability is not available. The pre-patch code did not validate the returned pointer and dereferenced it directly, producing a kernel NULL pointer dereference.

Root Cause

The defect is a missing NULL check on the return value of mt76_connac_get_eht_phy_cap() before the caller reads capability fields from the pointer. This is a classic [CWE-476] Null Pointer Dereference pattern in kernel driver code, where an API contract permits a NULL return but callers assume a valid pointer.

Attack Vector

The code path is reached during station association and beamforming negotiation on Wi-Fi 7 hardware. A malformed or unexpected association from a peer station that causes mt76_connac_get_eht_phy_cap() to return NULL can trigger the dereference and crash the kernel. Exploitation results in denial of service on the affected wireless host; there is no evidence of memory corruption or code execution primitives beyond the oops itself.

No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported for this issue.

Detection Methods for CVE-2026-68306

Indicators of Compromise

Kernel oops or panic messages referencing mt7996_mcu_sta_bfer_eht in stack traces from dmesg or /var/log/kern.log
Wireless interface resets or driver reinitialization events on MT7996-based adapters
Repeated station association failures preceding a driver crash on Wi-Fi 7 access points or clients

Detection Strategies

Correlate kernel crash telemetry with the loaded mt76 and mt7996 modules and compare against patched commit hashes
Monitor host EDR and system logs for unexpected kernel module reload sequences on Linux systems using MediaTek Wi-Fi hardware
Inventory endpoints by kernel version to identify hosts still running pre-patch builds of the mt76 driver

Monitoring Recommendations

Ingest dmesg and journald kernel facility logs into a centralized logging platform and alert on oops signatures containing mt7996_mcu_sta_bfer
Track driver and kernel package versions across the fleet to confirm patch adoption
Watch for abnormal Wi-Fi association failure rates on hosts using MT7996 chipsets, which may indicate probing of the vulnerable code path

How to Mitigate CVE-2026-68306

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix for mt7996_mcu_sta_bfer_eht()
Apply distribution-provided kernel updates once the fix has been backported to the relevant stable branch
Restrict untrusted stations from associating with affected access points until patching is complete

Patch Information

The fix adds a NULL check on the pointer returned by mt76_connac_get_eht_phy_cap() before it is dereferenced in mt7996_mcu_sta_bfer_eht(). Corresponding upstream and stable-tree commits are available for review:

Workarounds

Disable EHT/Wi-Fi 7 features on affected MT7996 interfaces where operationally acceptable until the patched kernel is deployed
Unload the mt7996e driver module on systems that do not require MediaTek Wi-Fi 7 functionality
Isolate affected wireless segments from untrusted clients to reduce the likelihood of reaching the vulnerable code path

bash

# Verify installed kernel version and loaded mt76 modules
uname -r
lsmod | grep -E 'mt76|mt7996'

# Temporarily unload the driver if the host does not require MT7996 Wi-Fi
sudo modprobe -r mt7996e

# Update kernel packages (Debian/Ubuntu example)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-//')