CVE-2026-68307 Overview
CVE-2026-68307 is a NULL pointer dereference vulnerability in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7925 chipset support. The flaw resides in the mt7925_vif_connect_iter() function used during reset recovery. When the driver replays firmware state for links tracked in mvif->valid_links, the bitmap can temporarily contain a link whose mac80211 bss_conf has already been removed. This condition passes a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), causing a kernel crash. The issue affects Multi-Link Operation (MLO) configurations and scenarios involving Microcontroller Unit (MCU) timeout recovery.
Critical Impact
A NULL pointer dereference during WiFi driver reset recovery causes kernel crashes, resulting in denial of service on systems using MediaTek MT7925 wireless chipsets.
Affected Products
- Linux kernel versions containing the mt76 driver with mt7925 support prior to the fix
- Systems using MediaTek MT7925 WiFi chipsets
- Linux distributions shipping affected kernel versions with MLO-capable wireless
Discovery Timeline
- 2026-08-10 - CVE-2026-68307 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68307
Vulnerability Analysis
The vulnerability occurs in the MediaTek mt7925 WiFi driver during reset recovery workflows. The mt7925_mac_reset_work() function invokes mt7925_vif_connect_iter() to replay firmware state for each active link tracked in the driver's mvif->valid_links bitmap. In Multi-Link Operation (MLO) deployments, this bitmap tracks multiple concurrent radio links associated with a single virtual interface.
The race between the driver's internal bitmap state and mac80211's link configuration creates a window where a link identifier remains set in valid_links even though the corresponding bss_conf structure has already been torn down by the upper WiFi stack. The kernel crash trace confirms the failure occurs at mt76_connac_mcu_uni_add_dev+0x8c/0x1f8, with register x1 (the bss_conf argument) holding NULL.
Root Cause
The root cause is a state synchronization gap between the mt76 driver's link bitmap and mac80211's per-link bss_conf structures. After MLO link changes or MCU timeout recovery, the driver iterates over valid_links without verifying that each corresponding bss_conf pointer is still valid. The helper function returns a NULL bss_conf for the stale link, which the caller passes unchecked to mt76_connac_mcu_uni_add_dev(). This is a classic NULL pointer dereference [CWE-476] triggered by a time-of-check to time-of-use pattern in link state tracking.
Attack Vector
Exploitation is local and requires conditions that trigger the WiFi driver reset path, such as firmware MCU timeouts or MLO link reconfiguration events. An attacker with the ability to induce driver resets, or a user encountering environmental conditions that cause MCU timeouts, can trigger the kernel crash. The impact is limited to denial of service through kernel panic on systems using the MT7925 chipset. The upstream fix skips missing bss_conf entries before replaying the link, preserving non-MLO AP and station reset replay behavior.
The vulnerability manifests only during reset recovery paths. See the upstream kernel patch commits for the corrective logic that validates bss_conf before dereferencing.
Detection Methods for CVE-2026-68307
Indicators of Compromise
- Kernel oops or panic messages referencing mt76_connac_mcu_uni_add_dev in the call trace
- Crash traces containing mt7925_vif_connect_iter and mt7925_mac_reset_work frames
- Repeated WiFi disconnections coinciding with kernel log entries about MCU timeouts on MT7925 hardware
Detection Strategies
- Monitor dmesg and /var/log/kern.log for NULL pointer dereference traces matching the mt7925 call stack
- Correlate WiFi interface reset events with subsequent kernel warnings on MediaTek chipsets
- Track kernel version inventory against the fixing commits published on git.kernel.org stable branches
Monitoring Recommendations
- Aggregate kernel crash telemetry from Linux endpoints to identify recurring mt7925 reset failures
- Alert on unexpected WiFi driver module reloads or interface reinitialization sequences
- Track kernel package versions across the fleet to confirm patch deployment status
How to Mitigate CVE-2026-68307
Immediate Actions Required
- Update the Linux kernel to a version containing the upstream fix commits referenced by the kernel stable tree
- Identify endpoints and embedded devices shipping MediaTek MT7925 WiFi hardware for prioritized patching
- Restart affected systems after applying the kernel update to activate the corrected driver
Patch Information
The fix is available in the Linux kernel stable tree through commits 89d03bda560d, 95b0cf02731c, bd8b2ec83818, and d9326796a378. The patch modifies mt7925_vif_connect_iter() to skip missing bss_conf entries before replaying a link, preventing NULL pointer dereferences during reset recovery. See the Linux kernel stable commit for the reference implementation.
Workarounds
- Disable Multi-Link Operation (MLO) features where supported by driver configuration to reduce reset replay exposure
- Unload the mt7925 and mt76_connac_lib modules on systems that do not require WiFi until a patched kernel is deployed
- Constrain wireless conditions that trigger MCU timeouts, such as reducing signal interference and unstable link environments
# Verify running kernel version and mt7925 module status
uname -r
lsmod | grep -E 'mt7925|mt76_connac'
# After patch installation, confirm module reload
sudo modprobe -r mt7925e
sudo modprobe mt7925e
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
