CVE-2026-68194
Description
A flaw was found in the Linux kernel's mt76 WiFi driver. When the driver processes a TXRX_NOTIFY event on non-Memory-Mapped I/O (MMIO) buses, such as USB or SDIO, it attempts to call a null function pointer. This can lead to a kernel NULL pointer dereference, causing a system crash and resulting in a Denial of Service (DoS).
Statement
This issue affects MediaTek mt7921 on non-MMIO buses (USB). MMIO-only TXRX_NOTIFY dispatched to tx_free on USB path. Systems without mt7921 USB Wi-Fi are not affected.
Mitigation
To mitigate this issue, prevent the mt7921u module from loading. See https://access.redhat.com/solutions/41278 for instructions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
