CVE-2026-99060: wifi: mt76: mt7603: initialize global station WCID

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7603: initialize global station WCID

mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76registerdevice(), this WCID is published without ever being passed to mt76wcidinit().

Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76tx() queues every such frame on the WCID's txpending or txoffchannel queue and links its txlist. The first injected frame therefore reaches skbqueuetail() with an uninitialized skbuffhead and dereferences a NULL prev pointer.

Initialize the WCID before publishing it.

The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.