CVE-2026-68194: wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921: drop TXRXNOTIFY on non-mmio buses
PKTTYPETXRXNOTIFY is an mmio-only event, but mt7921rxcheck() and mt7921queuerxskb() dispatch it to mt7921mactxfree() on every bus. mt7921mactxfree() cleans the DMA tx queues with mt76queuetxcleanup(), which calls queueops->txcleanup(). Only the mmio queue ops implement that callback; on USB and SDIO it is NULL, so a TXRXNOTIFY there calls a NULL pointer in the RX worker:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7921mactxfree+0x64/0x310 [mt7921common] mt7921rxcheck+0x5f/0xf0 [mt7921common] mt76urxworker+0x1b9/0x620 [mt76usb]
Drop the event on non-mmio buses via mt76ismmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses)to a version that resolves this vulnerability.Patch 5683e1488aa9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68194?
CVE-2026-68194 has a risk rating of 33.
How do I fix CVE-2026-68194?
To fix CVE-2026-68194, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-68194?
CVE-2026-68194 affects systems running a vulnerable version of the Linux kernel utilizing the mt76 driver.
What type of vulnerability is CVE-2026-68194?
CVE-2026-68194 is categorized as a Null Pointer Dereference vulnerability.
What is the impact of CVE-2026-68194 on system performance?
The impact of CVE-2026-68194 may result in system instability or crashes when handling specific TXRX_NOTIFY events.