CVE-2026-80632: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues()
When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues() will dereference a NULL WED pointer. Fix the issue by always passing the WED pointer from mt7996dmainit().
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue requires the Linux kernel mt7996 Wi-Fi driver with both MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED enabled, on a system where mt76 correctly detects an Airoha NPU SoC.
What triggers the failure?
During mt7996 transmit-queue initialization, the driver can dereference a NULL WED pointer under the affected configuration.
What is the remediation?
Apply the kernel fix that ensures mt7996_dma_init() always passes the WED pointer to mt7996_init_tx_queues().
How can I determine whether my system is exposed?
Check whether the mt7996 driver is in use and whether the kernel was built with MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED enabled on hardware where an Airoha NPU SoC is detected.