CVE-2026-68194

wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB and SDIO it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker:

BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7921_mac_tx_free+0x64/0x310 [mt7921_common] mt7921_rx_check+0x5f/0xf0 [mt7921_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb]

Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices").

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	48fab5bbef4092d925ab3214773ad12e68807223 to before 7003a2cbddd7917933c1f169c7874cfa6ab852c3Affected 48fab5bbef4092d925ab3214773ad12e68807223 to before ef2ee5f820c3ef87643b51e960c20b4a14d8336bAffected 48fab5bbef4092d925ab3214773ad12e68807223 to before ecf995b828191829ba4a87169bccabcbeb5c9c32Affected 48fab5bbef4092d925ab3214773ad12e68807223 to before 263816e92e8d66c81c98ccab2b5d2191ed08ec71Affected 48fab5bbef4092d925ab3214773ad12e68807223 to before 24475d2ddc8d8dfd82f4d2be0d951401f86911a6Affected 48fab5bbef4092d925ab3214773ad12e68807223 to before da4082e91acabc1498611ed8ccc53f0610baefc6Affected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

48fab5bbef4092d925ab3214773ad12e68807223 to before 7003a2cbddd7917933c1f169c7874cfa6ab852c3Affected
48fab5bbef4092d925ab3214773ad12e68807223 to before ef2ee5f820c3ef87643b51e960c20b4a14d8336bAffected
48fab5bbef4092d925ab3214773ad12e68807223 to before ecf995b828191829ba4a87169bccabcbeb5c9c32Affected
48fab5bbef4092d925ab3214773ad12e68807223 to before 263816e92e8d66c81c98ccab2b5d2191ed08ec71Affected
48fab5bbef4092d925ab3214773ad12e68807223 to before 24475d2ddc8d8dfd82f4d2be0d951401f86911a6Affected
48fab5bbef4092d925ab3214773ad12e68807223 to before da4082e91acabc1498611ed8ccc53f0610baefc6Affected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.