CVE-2026-68310: Linux Kernel Privilege Escalation Flaw

CVE-2026-68310 Overview

CVE-2026-68310 is a null pointer dereference vulnerability in the Linux kernel's mt76 wireless driver, specifically the mt7915 chipset support code. The flaw resides in the functions mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv(), which handle High Efficiency (HE, Wi-Fi 6) capability configuration. Both functions dereference the pointer returned by mt76_connac_get_he_phy_cap() without verifying that the pointer is non-NULL. When no capability entry matches the virtual interface (vif) type, the helper returns NULL, leading to a kernel-mode null pointer dereference and a subsequent crash.

Critical Impact
A null pointer dereference in kernel-mode driver code can trigger a system crash (kernel oops or panic), resulting in denial of service on affected Linux hosts using MediaTek MT7915 Wi-Fi hardware.

Affected Products

Linux kernel versions containing the mt76 MediaTek wireless driver prior to the fix commits
Systems using MediaTek MT7915 Wi-Fi 6 chipsets
Distributions shipping the affected mt7915 driver in mainline and stable kernel branches

Discovery Timeline

2026-08-10 - CVE-2026-68310 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68310

Vulnerability Analysis

The vulnerability exists in the MediaTek mt76 Wi-Fi driver's handling of HE (High Efficiency, 802.11ax) capability metadata. Two functions, mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv(), execute after an initial check that HE support is present on the interface. Both then call mt76_connac_get_he_phy_cap() to retrieve the HE physical-layer capability structure for the current virtual interface type.

The helper mt76_connac_get_he_phy_cap() may return NULL when no capability entry matches the vif type. The affected code paths did not validate the returned pointer before dereferencing it to append the TLV (type-length-value) fields. The resulting null pointer dereference occurs in kernel context and produces a kernel oops.

The upstream fix reorders the logic to fetch the capability first and skip the HE-specific TLV setup entirely when no matching capability entry is available. Related commits are tracked as 23a2b98, 6f99a56, 8715498, 8e9db06, and a031f45.

Root Cause

The root cause is missing null pointer validation on the return value of mt76_connac_get_he_phy_cap(). The existing HE-support precondition does not guarantee that a matching capability entry exists for every supported vif type, so the helper can legitimately return NULL under specific configurations.

Attack Vector

Triggering the code path requires association or beamforming setup involving an interface type for which no matching HE PHY capability entry exists. In practice, this is reachable during normal wireless operation on affected hardware and may be induced by specific vif configurations or association scenarios. The vulnerability produces a denial of service through kernel crash rather than code execution or privilege escalation.

See upstream commits 23a2b98, 6f99a56, 8715498, 8e9db06, and a031f45 on
git.kernel.org for the exact source-level changes to mt7915_mcu.c.

Detection Methods for CVE-2026-68310

Indicators of Compromise

Kernel oops or panic messages referencing mt7915_mcu_bss_he_tlv or mt7915_mcu_sta_bfer_tlv in dmesg or /var/log/kern.log
Unexpected wireless interface resets or driver reload events on hosts with MediaTek MT7915 hardware
Null pointer dereference call traces originating in the mt76 module

Detection Strategies

Inventory Linux hosts running kernels that predate the fix commits and identify those with MT7915 chipsets using lspci -k or lsmod | grep mt7915
Correlate kernel crash telemetry with mt76 module symbols to distinguish this issue from unrelated wireless faults
Monitor for repeated wireless driver restarts as a signal of exploitation attempts or naturally triggered crashes

Monitoring Recommendations

Forward kernel logs (journald, syslog) to a centralized logging platform and alert on BUG: or Oops: entries referencing mt76 or mt7915
Track kernel package versions across the fleet and flag hosts running unpatched stable branches
Enable kdump on affected hosts to capture crash dumps for post-incident analysis

How to Mitigate CVE-2026-68310

Immediate Actions Required

Apply the latest Linux stable kernel update from your distribution containing commits 23a2b98, 6f99a56, 8715498, 8e9db06, or a031f45
Identify all systems using MediaTek MT7915 Wi-Fi hardware and prioritize patching those endpoints
Reboot systems after kernel updates to ensure the fixed mt76 module is loaded

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable branches. Refer to the upstream commits: Linux Kernel Commit 23a2b98, Linux Kernel Commit 6f99a56, Linux Kernel Commit 8715498, Linux Kernel Commit 8e9db06, and Linux Kernel Commit a031f45.

Workarounds

Disable the mt7915e and mt7915 kernel modules on hosts that do not require MediaTek Wi-Fi 6 connectivity until patches are applied
Restrict wireless interface configurations to vif types known to have matching HE capability entries in the affected driver
Use wired networking on impacted hosts if uptime is critical and patching must be scheduled

bash

# Check kernel version and mt76 module presence
uname -r
lsmod | grep -E 'mt76|mt7915'

# Temporarily unload the driver as a mitigation (requires no active mt7915 Wi-Fi)
sudo modprobe -r mt7915e
sudo modprobe -r mt7915_common

# Blacklist the module until patched kernel is deployed
echo 'blacklist mt7915e' | sudo tee /etc/modprobe.d/mt7915-blacklist.conf
sudo update-initramfs -u