Medium [CVE-2026-68307] fix crash in reset link replay
This medium-severity Red Hat Linux advisory covers CVE-2026-68307 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux for NVIDIA 26.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links.
After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily contain a link whose mac80211 bss_conf has already gone away.
This can pass a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), matching the crash where x1, the second argument, is NULL: pc: mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] lr: mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] x2: ffffff80a77f6018 x1: 0000000000000000 x0: ffffff8099402080 Call trace: mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common] Skip missing bss_conf entries before replaying the link.
Non-MLO AP/STA reset replay is unchanged because the helper still returns &vif->bss_conf for the legacy link. A flaw was found in the MediaTek mt7925 Wi-Fi driver within the Linux kernel.
During a reset recovery process, the driver can attempt to access a network configuration that no longer exists. This can lead to a null pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).
This issue affects MediaTek mt7925 Wi-Fi with MLO.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
- kernel-0:6.12.0-211.53.1.el10_2
- RHSA-2026:65334
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Mitigation checklist
- To mitigate this issue, prevent the mt7925e module from loading. See https://access.redhat.com/solutions/41278 for instructions.
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.