CVE-2026-68195: wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses
PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck() and mt7615queuerxskb() dispatch it to mt7615mactxfree() on every bus. mt7615mactxfree() cleans the DMA tx queues with mt76queuetxcleanup(), which calls queueops->txcleanup(). Only the mmio queue ops implement that callback; on the mt7663 USB and SDIO buses it is NULL, so a TXRXNOTIFY there calls a NULL pointer in the RX worker. Same defect as the mt7921 and mt7925 patches in this series.
Drop the event on non-mmio buses via mt76ismmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (wifi: mt76: mt76/mt7615)to a version that resolves this vulnerability.Patch 5683e1488aa9 - Configuration
Modify mt7615_rx_check() so that PKT_TYPE_TXRX_NOTIFY is only handled when mt76_is_mmio() indicates an mmio bus; on non-mmio buses ensure the TXRX_NOTIFY path does not dispatch a NULL pointer callback (as described: TXRX_NOTIFY there calls a NULL pointer in RX worker).
mt7615_rx_check() mt76_is_mmio() handling for PKT_TYPE_TXRX_NOTIFY = Drop/ignore PKT_TYPE_TXRX_NOTIFY callbacks on non-mmio buses (queue_ops->tx_cleanup not dispatched) - Configuration
Ensure the TXRX_NOTIFY event/queue cleanup dispatch uses the correct mmio queue operations: non-mmio devices should not trigger the callback that results in a NULL pointer call (the series states this is implemented by the mt7663 USB and SDIO path cleaning DMA tx queues with mt7615_queue_rx_skb() dispatching it to mt7615_mac_tx_free()).
mt7615_queue_rx_skb()/mt7615_mac_tx_free() tx queue cleanup dispatch = Only dispatch tx_cleanup/cleanup to mt7615_mac_tx_free() via queue_ops->tx_cleanup for mmio queue ops; do not dispatch on non-mmio devices
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68195?
The severity of CVE-2026-68195 is rated at 53.
What does CVE-2026-68195 affect?
CVE-2026-68195 affects the Linux kernel, specifically related to the mt76 and mt7615 drivers.
How do I fix CVE-2026-68195?
To fix CVE-2026-68195, you should update the Linux kernel to the latest version that includes the patch.
What kind of vulnerability is CVE-2026-68195?
CVE-2026-68195 is a vulnerability related to improper handling of TXRX_NOTIFY on non-mmio buses.
Is CVE-2026-68195 a serious threat?
CVE-2026-68195 could potentially disrupt wireless communication due to its impact on hardware driver functionality.