CVE-2026-68309: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68309 Overview

CVE-2026-68309 is a NULL pointer dereference vulnerability in the Linux kernel's MediaTek mt76 WiFi driver. The flaw resides in the mt76_connac_mcu_uni_bss_he_tlv() function within the connac driver code. The routine mt76_connac_get_he_phy_cap() can theoretically return NULL, but the calling code dereferenced the returned cap pointer without validating it first. An unchecked dereference in kernel space can trigger a kernel oops and lead to a denial-of-service condition on systems using MediaTek WiFi hardware supported by the mt76 driver.

Critical Impact
A NULL pointer dereference in the kernel WiFi driver can crash the kernel, resulting in denial of service on affected Linux systems using MediaTek mt76 chipsets.

Affected Products

Linux kernel builds shipping the mt76 MediaTek WiFi driver
Systems using the mt76_connac module for MediaTek chipsets
Distributions running kernels prior to the referenced stable fixes

Discovery Timeline

2026-08-10 - CVE-2026-68309 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68309

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the MediaTek mt76 wireless driver, specifically within mt76_connac_mcu_uni_bss_he_tlv(). This function constructs High Efficiency (HE, 802.11ax) TLV structures sent to the WiFi microcontroller (MCU) during Basic Service Set (BSS) configuration. The function calls mt76_connac_get_he_phy_cap() to retrieve the HE physical layer capability structure for the current band and interface.

The helper mt76_connac_get_he_phy_cap() can return NULL under certain conditions, for example when no matching capability entry exists for the requested band or interface type. The caller did not check the return value before dereferencing the cap pointer to read HE PHY capability fields. When the returned pointer is NULL, the dereference triggers a kernel oops.

Root Cause

The root cause is a missing pointer validation check between the retrieval of the HE PHY capability structure and its use. The kernel assumed a non-NULL return value from mt76_connac_get_he_phy_cap(), but the helper's control flow allows a NULL return. The patch adds an explicit NULL check on the cap pointer before it is dereferenced, ensuring the TLV construction path safely bails out when capability data is unavailable.

Attack Vector

Exploitation requires triggering a code path that leads to mt76_connac_mcu_uni_bss_he_tlv() being invoked under conditions where mt76_connac_get_he_phy_cap() returns NULL. This typically occurs during BSS configuration operations tied to interface setup or association events on affected MediaTek WiFi hardware. The vulnerability manifests as a kernel crash rather than memory corruption, so impact is limited to availability. No verified public exploit is available. See the upstream fix in Kernel Git Commit 2afc2d5 for the exact code path and remediation.

Detection Methods for CVE-2026-68309

Indicators of Compromise

Kernel oops or panic messages referencing mt76_connac_mcu_uni_bss_he_tlv in dmesg output
Sudden loss of WiFi connectivity coupled with kernel stack traces mentioning the mt76 or mt76_connac modules
Repeated crashes correlated with WiFi interface bring-up or association attempts on MediaTek hardware

Detection Strategies

Monitor kernel logs (journalctl -k, /var/log/kern.log) for NULL pointer dereference traces involving mt76_connac
Inventory Linux hosts running unpatched kernel versions with the mt76 driver loaded (lsmod | grep mt76)
Correlate WiFi driver crash telemetry across fleets to identify systematic exposure

Monitoring Recommendations

Forward kernel log events to a centralized SIEM for pattern detection across endpoints
Alert on repeated kernel oops entries referencing mt76_connac_mcu_uni_bss_he_tlv or nearby symbols
Track kernel package versions in the asset inventory to confirm patch coverage on wireless-enabled Linux endpoints

How to Mitigate CVE-2026-68309

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git commits
Update to a distribution kernel that includes the mt76_connac NULL check fix
Reboot affected systems after kernel updates to load the patched driver
Prioritize patching on laptops, embedded devices, and access points using MediaTek WiFi chipsets

Patch Information

The fix adds a NULL check on the cap pointer returned by mt76_connac_get_he_phy_cap() before it is dereferenced in mt76_connac_mcu_uni_bss_he_tlv(). Patched commits are available in the mainline and stable kernel trees: Kernel Git Commit 2afc2d5, Kernel Git Commit 2c1fb23, Kernel Git Commit 8709c66, Kernel Git Commit b09508d, and Kernel Git Commit c058786.

Workarounds

Temporarily unload the mt76_connac module (modprobe -r mt76_connac) on systems where WiFi is not required
Blacklist the affected driver until patched kernels are deployed, using a modprobe blacklist configuration
Disable 802.11ax (HE) operation in the wireless supplicant to avoid the vulnerable HE TLV construction path where feasible

bash

# Verify kernel version and mt76 module status
uname -r
lsmod | grep mt76

# Optional: blacklist the driver until the patched kernel is installed
echo "blacklist mt76_connac" | sudo tee /etc/modprobe.d/blacklist-mt76.conf
sudo update-initramfs -u