CVE-2026-68193: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses
PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck() and mt7925queuerxskb() dispatch it to mt7925mactxfree() on every bus. mt7925mactxfree() cleans the DMA tx queues with mt76queuetxcleanup(), which calls queueops->txcleanup(). Only the mmio queue ops implement that callback; on USB it is NULL, so a TXRXNOTIFY there calls a NULL pointer in the RX worker:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7925mactxfree+0x58/0x350 [mt7925common] mt7925rxcheck+0xe2/0x130 [mt7925common] mt76urxworker+0x1b9/0x620 [mt76usb]
Drop the event on non-mmio buses via mt76ismmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio busesto a version that resolves this vulnerability.Patch 5683e1488aa9 - Compensating control
If upgrading immediately is not possible, mitigate by ensuring TXRX_NOTIFY events are dropped on non-mmio buses (only allow PKT_TYPE_TXRX_NOTIFY on mmio-only paths as described for mt76_is_mmio()).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68193?
CVE-2026-68193 has a risk rating of 33, indicating a moderate severity level.
How do I fix CVE-2026-68193?
To fix CVE-2026-68193, update your Linux kernel to the latest stable version where the vulnerability has been resolved.
What type of vulnerability is CVE-2026-68193?
CVE-2026-68193 is classified as a Null Pointer Dereference vulnerability in the Linux kernel.
Which component of the Linux kernel is affected by CVE-2026-68193?
CVE-2026-68193 specifically affects the wifi mt76 driver, particularly the mt7925 component.
When was CVE-2026-68193 published?
CVE-2026-68193 was published on August 10, 2026.