UBUNTU-CVE-2026-68193: Null Pointer Dereference

Published Aug 10, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck() and mt7925queuerxskb() dispatch it to mt7925mactxfree() on every bus. mt7925mactxfree() cleans the DMA tx queues with mt76queuetxcleanup(), which calls queueops->txcleanup(). Only the mmio queue ops implement that callback; on USB it is NULL, so a TXRXNOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7925mactxfree+0x58/0x350 [mt7925common] mt7925rxcheck+0xe2/0x130 [mt7925common] mt76urxworker+0x1b9/0x620 [mt76usb] Drop the event on non-mmio buses via mt76ismmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

Affected Software

161 affected componentsFixes available
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm-6.8*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8*
ubuntu/linux<6.8.0-147.147
6.8.0-147.147
ubuntu/linux-aws<6.8.0-1067.70
6.8.0-1067.70
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17*
ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1
7.0.0-1014.14~24.04.1
ubuntu/linux-azure<6.8.0-1071.79
6.8.0-1071.79
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17*
ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1
7.0.0-1017.17~24.04.1
ubuntu/linux-azure-fde<6.8.0-1069.76
6.8.0-1069.76
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1
7.0.0-1016.16~24.04.1
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1071.79
6.8.0-1071.79
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1
7.0.0-1014.14~24.04.1
ubuntu/linux-gke<6.8.0-1066.74
6.8.0-1066.74
ubuntu/linux-gkeop<6.8.0-1052.56
6.8.0-1052.56
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17*
ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4
7.0.0-38.38~24.04.4
ubuntu/linux-ibm<6.8.0-1067.68
6.8.0-1067.68
ubuntu/linux-lowlatency<6.8.0-147.147.1
6.8.0-147.147.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17*
ubuntu/linux-nvidia-7.0*
ubuntu/linux-nvidia-lowlatency*
ubuntu/linux-nvidia-tegra*
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1064.67
6.8.0-1064.67
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17*
ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1
7.0.0-1013.13~24.04.1
ubuntu/linux-raspi*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1
7.0.0-38.38.1~24.04.1
ubuntu/linux-xilinx*
ubuntu/linux-bluefield<6.8.0-1033.38
6.8.0-1033.38
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime<6.8.1-1062.63
6.8.1-1062.63
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17*
ubuntu/linux-aws-fips<6.8.0-1067.70+fips1
6.8.0-1067.70+fips1
ubuntu/linux-azure-fips<6.8.0-1071.79+fips1
6.8.0-1071.79+fips1
ubuntu/linux-fips<6.8.0-147.147+fips1
6.8.0-147.147+fips1
ubuntu/linux-gcp-fips<6.8.0-1071.79+fips1
6.8.0-1071.79+fips1
ubuntu/linux<7.0.0-38.38
7.0.0-38.38
ubuntu/linux-aws<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-azure<7.0.0-1017.17
7.0.0-1017.17
ubuntu/linux-azure-fde<7.0.0-1016.16
7.0.0-1016.16
ubuntu/linux-gcp<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-gke<7.0.0-1008.9
7.0.0-1008.9
ubuntu/linux-ibm<7.0.0-1015.15
7.0.0-1015.15
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-bos*
ubuntu/linux-oem-7.0<7.0.0-1015.15
7.0.0-1015.15
ubuntu/linux-oracle<7.0.0-1013.13
7.0.0-1013.13
ubuntu/linux-raspi*
ubuntu/linux-realtime<7.0.0-38.38.1
7.0.0-38.38.1
ubuntu/linux-riscv<7.0.0-38.38.1
7.0.0-38.38.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147
  2. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70
  3. Upgrade

    Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14~24.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79
  5. Upgrade

    Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17~24.04.1
  6. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.76
  7. Upgrade

    Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16~24.04.1
  8. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79
  9. Upgrade

    Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14~24.04.1
  10. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1066.74
  11. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.56
  12. Upgrade

    Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38~24.04.4
  13. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.68
  14. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147.1
  15. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.67
  16. Upgrade

    Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13~24.04.1
  17. Upgrade

    Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38.1~24.04.1
  18. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.38
  19. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1062.63
  20. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70+fips1
  21. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79+fips1
  22. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147+fips1
  23. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79+fips1
  24. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38
  25. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  26. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17
  27. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16
  28. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  29. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 7.0.0-1008.9
  30. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1015.15
  31. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1015.15
  32. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13
  33. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38.1
  34. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38.1
  35. Compensating control

    On non-mmio buses, drop PKT_TYPE_TXRX_NOTIFY using mt76_is_mmio() before dispatching it to mt7925_mac_tx_free().

Event History

Aug 10, 2026
CVE Published
via OSV·01:20 PM
Data Sourced
via OSV·01:20 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

Which deployments are affected by this issue?

The issue applies to systems using an mt7925 device on a non-MMIO bus, specifically the USB receive path. The affected Ubuntu kernel packages listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.

2

Are MMIO-connected devices affected by the NULL callback path?

No. PKT_TYPE_TXRX_NOTIFY is an MMIO-only event, and the fault occurs when it is processed on non-MMIO buses where the USB queue operations do not provide the tx_cleanup callback.

3

What failure should operators look for?

Affected systems may hit a kernel NULL pointer dereference in the RX worker. The reported call trace includes mt7925_mac_tx_free, mt7925_rx_check, and mt76u_rx_worker.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203