High 8.8Published Jul 19, 2026

CVE-2026-63832wifi: mt76: add wcid publish check in mt76_sta_add

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	4911e4cb157cf87d5bdb3fa8e0c200032443371e builds before 3c499851753a24d2e148d4e9ca51764c0c51554e; 4911e4cb157cf87d5bdb3fa8e0c200032443371e builds before 55e014aaec650ede08b693ba59c8d0443f13f11c; 4911e4cb157cf87d5bdb3fa8e0c200032443371e builds before 20b126920a259df4d7dcae19fcfe2c57a74d6b2e; c9389e3f9453ec2d710e61830eafedddfd561226; 57d3f833087942ded1a8765b1b361454d3d39e8f; from 6.12.13 before 6.13; from 6.13.2 before 6.14	CNA record

References

https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e
https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c
https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.