CVE-2026-80632 Overview
CVE-2026-80632 is a NULL pointer dereference vulnerability in the Linux kernel's mt76 wireless driver, specifically in the mt7996_init_tx_queues() function. The flaw occurs when both MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are enabled and the driver correctly detects the Airoha Network Processing Unit (NPU) System-on-Chip (SoC). Under this configuration, the driver dereferences a NULL Wireless Ethernet Dispatch (WED) pointer during transmit queue initialization. The upstream fix always passes the WED pointer from mt7996_dma_init() to the initialization routine, preventing the dereference.
Critical Impact
A NULL pointer dereference during wireless driver initialization causes a kernel oops, resulting in denial of service on affected MediaTek MT7996 Wi-Fi hardware paired with Airoha NPU SoCs.
Affected Products
- Linux kernel builds including the mt76 driver with MT7996 support
- Kernels compiled with MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED enabled
- Systems using Airoha NPU SoC hardware with MediaTek MT7996 wireless
Discovery Timeline
- 2026-08-28 - CVE-2026-80632 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80632
Vulnerability Analysis
The vulnerability resides in mt7996_init_tx_queues(), a function responsible for setting up transmit queues for MediaTek MT7996 wireless chipsets. The mt76 driver uses a Wireless Ethernet Dispatch (WED) pointer to offload packet processing to hardware acceleration engines. When the driver operates on an Airoha NPU SoC and both MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED kernel options are enabled, the code path fails to propagate a valid WED pointer to the queue initialization routine. The function then dereferences NULL, triggering a kernel panic or oops [CWE-476].
Root Cause
The root cause is an incorrect assumption about WED pointer availability across configurations. The caller mt7996_dma_init() did not consistently pass the WED pointer to mt7996_init_tx_queues() when the Airoha NPU path was active. The corrective commits (6794edb and 93f3f9a) ensure the WED pointer is always forwarded, eliminating the conditional path that produced a NULL reference.
Attack Vector
This vulnerability is triggered locally during driver initialization on affected hardware, not through remote network traffic. Exploitation requires the specific hardware combination and kernel configuration to reach the vulnerable code path. Impact is limited to denial of service through kernel crash. No known remote or privilege escalation vector exists for this issue.
See the Linux Kernel Commit 6794edb and Linux Kernel Commit 93f3f9a for the exact code changes.
Detection Methods for CVE-2026-80632
Indicators of Compromise
- Kernel oops or panic messages referencing mt7996_init_tx_queues in system logs
- Wireless interface initialization failures on MT7996 hardware with Airoha NPU SoCs
- dmesg output containing NULL pointer dereference traces in the mt76 module stack
Detection Strategies
- Audit running kernel versions against the fixed commits 6794edb and 93f3f9a on affected distributions
- Inspect kernel build configuration for simultaneous use of MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED
- Correlate wireless driver load failures with hardware inventory to identify affected Airoha NPU deployments
Monitoring Recommendations
- Forward kernel logs to a central logging platform and alert on BUG: or Oops: entries tied to the mt76 module
- Monitor wireless interface uptime and unexpected reboots on network appliances using MediaTek MT7996 chipsets
- Track kernel package versions across the fleet to confirm patch adoption
How to Mitigate CVE-2026-80632
Immediate Actions Required
- Apply the upstream Linux kernel commits 6794edb and 93f3f9a or update to a stable kernel release that includes these fixes
- Identify all systems using MT7996 wireless hardware combined with Airoha NPU SoCs and prioritize them for patching
- Reboot affected systems after upgrading to load the corrected mt76 driver
Patch Information
The issue is resolved by two upstream kernel commits: Linux Kernel Commit 6794edb and Linux Kernel Commit 93f3f9a. The fix ensures mt7996_dma_init() always passes the WED pointer into mt7996_init_tx_queues(), removing the NULL dereference path.
Workarounds
- Disable CONFIG_NET_MEDIATEK_SOC_WED when rebuilding the kernel to avoid the vulnerable code path if patching is not immediately possible
- Disable MT76_NPU support in the kernel configuration on affected devices to sidestep the Airoha NPU initialization branch
- Avoid deploying MT7996 wireless hardware alongside Airoha NPU SoCs on unpatched kernels until updates are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.