All vulnerabilities
CVE-2026-99060

Linux: wifi: mt76: mt7603: initialize global station WCID

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in99b8bd6323e6fc69615af828522878b7acb77bffAlso 19d6fa087dcf242223645828b8282d4040bad168, 456de496b53ae73e6e3020fec815dbdc88aa7c07 and 1 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 99b8bd6323e6fc69615af828522878b7acb77bffLinuxCVE List
  • 19d6fa087dcf242223645828b8282d4040bad168LinuxCVE List
  • 456de496b53ae73e6e3020fec815dbdc88aa7c07LinuxCVE List
  • 6.6.160LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7603: initialize global station WCID

mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init().

Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer.

Initialize the WCID before publishing it.

The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.

Text from CVE List

Affected versions 13

  • Linuxaffected: d2defcddfe90b3be0cfccc2482495ab1fb759586 before 99b8bd6323e6fc69615af828522878b7acb77bffCVE List
  • Linuxaffected: 0335c034e7265d36d956e806f33202c94a8a9860 before e454ec553996f21085657c96c8a605e2d89a81a6CVE List
  • Linuxaffected: 0335c034e7265d36d956e806f33202c94a8a9860 before dd117d17e8aa2e89f857fb708e5b770709fb81cbCVE List
  • Linuxaffected: 0335c034e7265d36d956e806f33202c94a8a9860 before 19d6fa087dcf242223645828b8282d4040bad168CVE List
  • Linuxaffected: 0335c034e7265d36d956e806f33202c94a8a9860 before 456de496b53ae73e6e3020fec815dbdc88aa7c07CVE List
  • Linuxaffected: 6.6.48 before 6.6.160CVE List
  • Linuxaffected: 6.7CVE List
  • Linuxunaffected: all versions before 6.7CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5