CVE-2026-63832

wifi: mt76: add wcid publish check in mt76_sta_add

State: Published
Severity: 8.8 High
Published: Jul 19, 2026
Updated: Oct 21, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: add wcid publish check in mt76_sta_add

Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list.

Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself.

wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).

mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-662 Improper Synchronization

Affected Products

Product	Versions
LinuxLinux	c9389e3f9453ec2d710e61830eafedddfd561226 to before 720f39a9c60fdb604291c630f4f157753b376d68Affected 4911e4cb157cf87d5bdb3fa8e0c200032443371e to before 3c499851753a24d2e148d4e9ca51764c0c51554eAffected 4911e4cb157cf87d5bdb3fa8e0c200032443371e to before 55e014aaec650ede08b693ba59c8d0443f13f11cAffected 4911e4cb157cf87d5bdb3fa8e0c200032443371e to before 20b126920a259df4d7dcae19fcfe2c57a74d6b2eAffected 57d3f833087942ded1a8765b1b361454d3d39e8fAffected 6.12.13 to before 6.12.114Affected 6.13.2 to before 6.14Affected
LinuxLinux	6.14Affected before 6.14Not affected 6.12.114 through 6.12.Not affected 6.18.38 through 6.18.Not affected 7.1.3 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c9389e3f9453ec2d710e61830eafedddfd561226 to before 720f39a9c60fdb604291c630f4f157753b376d68Affected
4911e4cb157cf87d5bdb3fa8e0c200032443371e to before 3c499851753a24d2e148d4e9ca51764c0c51554eAffected
4911e4cb157cf87d5bdb3fa8e0c200032443371e to before 55e014aaec650ede08b693ba59c8d0443f13f11cAffected
4911e4cb157cf87d5bdb3fa8e0c200032443371e to before 20b126920a259df4d7dcae19fcfe2c57a74d6b2eAffected
57d3f833087942ded1a8765b1b361454d3d39e8fAffected
6.12.13 to before 6.12.114Affected
6.13.2 to before 6.14Affected

LinuxLinux

6.14Affected
before 6.14Not affected
6.12.114 through 6.12.*Not affected
6.18.38 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.