CVE-2026-68194wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB and SDIO it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7921_mac_tx_free+0x64/0x310 [mt7921_common] mt7921_rx_check+0x5f/0xf0 [mt7921_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 48fab5bbef4092d925ab3214773ad12e68807223 before 7003a2cbddd7917933c1f169c7874cfa6ab852c3; from 48fab5bbef4092d925ab3214773ad12e68807223 before ef2ee5f820c3ef87643b51e960c20b4a14d8336b; from 48fab5bbef4092d925ab3214773ad12e68807223 before ecf995b828191829ba4a87169bccabcbeb5c9c32; from 48fab5bbef4092d925ab3214773ad12e68807223 before 263816e92e8d66c81c98ccab2b5d2191ed08ec71; from 48fab5bbef4092d925ab3214773ad12e68807223 before 24475d2ddc8d8dfd82f4d2be0d951401f86911a6; from 48fab5bbef4092d925ab3214773ad12e68807223 before da4082e91acabc1498611ed8ccc53f0610baefc6 | CNA record |
References
- https://git.kernel.org/stable/c/7003a2cbddd7917933c1f169c7874cfa6ab852c3
- https://git.kernel.org/stable/c/ef2ee5f820c3ef87643b51e960c20b4a14d8336b
- https://git.kernel.org/stable/c/ecf995b828191829ba4a87169bccabcbeb5c9c32
- https://git.kernel.org/stable/c/263816e92e8d66c81c98ccab2b5d2191ed08ec71
- https://git.kernel.org/stable/c/24475d2ddc8d8dfd82f4d2be0d951401f86911a6
- https://git.kernel.org/stable/c/da4082e91acabc1498611ed8ccc53f0610baefc6
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.