CVE-2026-63832: wifi: mt76: add wcid publish check in mt76_sta_add
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: add wcid publish check in mt76staadd
Since mt7925macstaadd publishes wcid, add publish check in mt76staadd to avoid reinitializing the wcid->polllist.
Found dev->stapolllist corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself.
wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 listadd corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).
mt76wcidaddpoll+0x95/0xd0 [mt76] mt7925macaddtxs.part.0+0xa5/0xe0 [mt7925common] mt7925rxcheck+0xa7/0xc0 [mt7925common] mt76dmarxpoll+0x50d/0x790 [mt76] mt792xpollrx+0x52/0xe0 [mt792xlib]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel mt76to a version that resolves this vulnerability.Patch wifi: mt76: add wcid publish check in mt76_sta_add
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63832?
The severity of CVE-2026-63832 is high with a CVSS score of 8.8.
What is the impact of CVE-2026-63832 on the Linux kernel?
CVE-2026-63832 can lead to the corruption of the sta_poll_list due to improper handling in the mt76_sta_add function.
How do I fix CVE-2026-63832?
To fix CVE-2026-63832, update to the latest version of the Linux kernel where this vulnerability has been addressed.
What systems are affected by CVE-2026-63832?
CVE-2026-63832 affects systems running the Linux kernel that include the mt76 and mt7925 drivers.
What should I do if I cannot immediately apply the patch for CVE-2026-63832?
If a patch cannot be applied immediately, consider implementing network segmentation or monitoring to mitigate potential exploitation of CVE-2026-63832.