CVE-2026-68311: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68311 Overview

CVE-2026-68311 is a NULL pointer dereference vulnerability in the Linux kernel's mt76 wireless driver, specifically affecting the mt7925 chipset support code. The flaw resides in mt7925_sta_set_decap_offload(), which iterates over a virtual interface's valid_links mask when updating decapsulation offload state for a Multi-Link Operation (MLO) station. A station may not have a link STA for every valid link of the vif, causing mt792x_sta_to_link() to return NULL. The function dereferences the returned mlink pointer before validating readiness, leading to a NULL pointer dereference.

Critical Impact
A NULL pointer dereference in the wireless driver can trigger a kernel oops or panic, causing denial of service on affected systems using MediaTek MT7925 Wi-Fi hardware with MLO-capable stations.

Affected Products

Linux kernel versions containing the mt76/mt7925 driver with MLO decap offload support
Systems using MediaTek MT7925 Wi-Fi 7 wireless chipsets
Distributions shipping affected upstream kernels prior to the stable backports

Discovery Timeline

2026-08-10 - CVE-2026-68311 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68311

Vulnerability Analysis

The vulnerability exists in the mt7925_sta_set_decap_offload() function within the MediaTek mt76 Wi-Fi driver. When updating decapsulation offload configuration for an MLO station, the function walks each link indicated by the vif's valid_links bitmask. For each bit set, it calls mt792x_sta_to_link() to obtain the corresponding per-link station structure (mlink).

MLO stations may present a subset of the vif's links, meaning mt792x_sta_to_link() legitimately returns NULL for links that exist on the vif but not on the station. The affected code path touched mlink->wcid to set or clear the MT_WCID_FLAG_HDR_TRANS flag before checking whether the link WCID was ready or whether mlink was non-NULL. Dereferencing a NULL mlink triggers a kernel-mode NULL pointer dereference [CWE-476].

Root Cause

The root cause is an ordering defect: the code accessed mlink->wcid prior to validating that mlink was returned as non-NULL. The upstream fix skips iterations where the station has no link STA for the current link, guarding the mlink->wcid access. The patch is available across multiple stable trees in commits 1e608ca, 96ea44f, d86883f, and f1ee53e.

Attack Vector

Triggering the defect requires an MLO-capable Wi-Fi client scenario where the vif exposes valid links that the station does not populate. This is a driver-internal state condition reachable during normal MLO association or reconfiguration flows on hosts using MT7925 hardware. Successful triggering produces a kernel NULL dereference, resulting in a crash rather than memory corruption or code execution. No verified exploit code is available at this time.

See the kernel commit d86883f for the patch content and the kernel commit f1ee53e for an additional backport reference.

Detection Methods for CVE-2026-68311

Indicators of Compromise

Kernel oops or panic traces referencing mt7925_sta_set_decap_offload in the call stack
BUG: kernel NULL pointer dereference messages accompanied by mt76/mt7925 module symbols
Repeated Wi-Fi interface resets or driver reload events on hosts using MT7925 chipsets
MLO association or reconfiguration events immediately preceding a kernel fault

Detection Strategies

Monitor dmesg and journalctl -k output for NULL pointer dereference traces implicating the mt7925 driver
Compare running kernel version against the fixed commits 1e608ca, 96ea44f, d86883f, and f1ee53e in stable trees
Track kernel crash reports and core dumps for signatures involving mt792x_sta_to_link and MT_WCID_FLAG_HDR_TRANS

Monitoring Recommendations

Aggregate kernel logs from Linux endpoints and correlate crash signatures across the fleet
Alert on unexpected wireless driver module reloads or interface flaps on MT7925-equipped systems
Include kernel version and driver commit inventory in configuration management to identify unpatched hosts

How to Mitigate CVE-2026-68311

Immediate Actions Required

Update Linux kernels to a version containing one of the fix commits: 1e608ca, 96ea44f, d86883f, or f1ee53e
Apply distribution vendor kernel updates as they become available for stable and long-term support branches
Inventory hosts and endpoints using MediaTek MT7925 wireless chipsets to prioritize patch deployment

Patch Information

The upstream Linux kernel patch guards the mlink->wcid access by skipping links without a station link entry before touching WCID flags. Fix commits are published in the stable tree at Kernel Git Commit 1e608ca, Kernel Git Commit 96ea44f, Kernel Git Commit d86883f, and Kernel Git Commit f1ee53e.

Workarounds

Disable Multi-Link Operation on affected wireless networks where feasible until patched kernels are deployed
Unload the mt7925 driver module on systems where the wireless interface is not required
Restrict use of MT7925 hardware in environments requiring high availability until the fix is applied

bash

# Verify running kernel and mt76 module version
uname -r
modinfo mt7925e | grep -E '^(version|srcversion|filename):'

# Temporarily unload the driver where wireless is not needed
sudo modprobe -r mt7925e mt7925_common mt76