CVE-2026-68307
- Source
- https://cve.org/CVERecord?id=CVE-2026-68307
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68307.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-68307
- Downstream
- Published
- 2026-08-10T12:02:41Z
- Modified
- 2026-08-18T03:30:53Z
- Summary
- wifi: mt76: mt7925: fix crash in reset link replay
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix crash in reset link replay
During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links. After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily contain a link whose mac80211 bss_conf has already gone away.
This can pass a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), matching the crash where x1, the second argument, is NULL:
pc : mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] lr : mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] x2 : ffffff80a77f6018 x1 : 0000000000000000 x0 : ffffff8099402080 Call trace: mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common]
Skip missing bss_conf entries before replaying the link. Non-MLO AP/STA reset replay is unchanged because the helper still returns &vif->bss_conf for the legacy link.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68307.json" }- References
-
- https://git.kernel.org/stable/c/89d03bda560d635f66d495f37b46a187fd4edfdf
- https://git.kernel.org/stable/c/95b0cf02731c74e073ef8937f5526bd4442a0326
- https://git.kernel.org/stable/c/bd8b2ec838184236c3fcbf738a926328836adf12
- https://git.kernel.org/stable/c/d9326796a378f80be5f9fd60983c62fdccdf2f0b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68307.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-68307
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced14061994184df6bb89cba31657ee1db24480e92aFixedd9326796a378f80be5f9fd60983c62fdccdf2f0bFixed95b0cf02731c74e073ef8937f5526bd4442a0326Fixed89d03bda560d635f66d495f37b46a187fd4edfdfFixedbd8b2ec838184236c3fcbf738a926328836adf12