CVE-2026-68194
Detail
Received This CVE record has recently been published to the CVE List and has been included within the NVD dataset.
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and
mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus.
mt7921_mac_tx_free() cleans the DMA tx queues with
mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the
mmio queue ops implement that callback; on USB and SDIO it is NULL, so
a TXRX_NOTIFY there calls a NULL pointer in the RX worker:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Call Trace:
mt7921_mac_tx_free+0x64/0x310 [mt7921_common]
mt7921_rx_check+0x5f/0xf0 [mt7921_common]
mt76u_rx_worker+0x1b9/0x620 [mt76_usb]
Drop the event on non-mmio buses via mt76_is_mmio(), as in
commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for
non-mmio devices").
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Change History
3 change records found show changes
CVE Modified by kernel.org
8/19/2026 1:20:35 PM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/7003a2cbddd7917933c1f169c7874cfa6ab852c3
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ef2ee5f820c3ef87643b51e960c20b4a14d8336b","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ecf995b828191829ba4a87169bccabcbeb5c9c32","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"263816e92e8d66c81c98ccab2b5d2191ed08ec71","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"24475d2ddc8d8dfd82f4d2be0d951401f86911a6","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"da4082e91acabc1498611ed8ccc53f0610baefc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"7003a2cbddd7917933c1f169c7874cfa6ab852c3","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ef2ee5f820c3ef87643b51e960c20b4a14d8336b","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ecf995b828191829ba4a87169bccabcbeb5c9c32","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"263816e92e8d66c81c98ccab2b5d2191ed08ec71","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"24475d2ddc8d8dfd82f4d2be0d951401f86911a6","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"da4082e91acabc1498611ed8ccc53f0610baefc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
CVE Modified by kernel.org
8/17/2026 1:18:21 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ef2ee5f820c3ef87643b51e960c20b4a14d8336b","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ecf995b828191829ba4a87169bccabcbeb5c9c32","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"263816e92e8d66c81c98ccab2b5d2191ed08ec71","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"24475d2ddc8d8dfd82f4d2be0d951401f86911a6","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"da4082e91acabc1498611ed8ccc53f0610baefc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ef2ee5f820c3ef87643b51e960c20b4a14d8336b","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ecf995b828191829ba4a87169bccabcbeb5c9c32","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"263816e92e8d66c81c98ccab2b5d2191ed08ec71","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"24475d2ddc8d8dfd82f4d2be0d951401f86911a6","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"da4082e91acabc1498611ed8ccc53f0610baefc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
New CVE Received from kernel.org
8/10/2026 9:20:06 AM
Action
Type
Old Value
New Value
Added
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and
mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus.
mt7921_mac_tx_free() cleans the DMA tx queues with
mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the
mmio queue ops implement that callback; on USB and SDIO it is NULL, so
a TXRX_NOTIFY there calls a NULL pointer in the RX worker:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Call Trace:
mt7921_mac_tx_free+0x64/0x310 [mt7921_common]
mt7921_rx_check+0x5f/0xf0 [mt7921_common]
mt76u_rx_worker+0x1b9/0x620 [mt76_usb]
Drop the event on non-mmio buses via mt76_is_mmio(), as in
commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for
non-mmio devices").
Added
Reference
https://git.kernel.org/stable/c/24475d2ddc8d8dfd82f4d2be0d951401f86911a6
Added
Reference
https://git.kernel.org/stable/c/263816e92e8d66c81c98ccab2b5d2191ed08ec71
Added
Reference
https://git.kernel.org/stable/c/da4082e91acabc1498611ed8ccc53f0610baefc6
Added
Reference
https://git.kernel.org/stable/c/ecf995b828191829ba4a87169bccabcbeb5c9c32
Added
Reference
https://git.kernel.org/stable/c/ef2ee5f820c3ef87643b51e960c20b4a14d8336b
Added
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ef2ee5f820c3ef87643b51e960c20b4a14d8336b","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"ecf995b828191829ba4a87169bccabcbeb5c9c32","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"263816e92e8d66c81c98ccab2b5d2191ed08ec71","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"24475d2ddc8d8dfd82f4d2be0d951401f86911a6","versionType":"git","status":"affected"},{"version":"48fab5bbef4092d925ab3214773ad12e68807223","lessThan":"da4082e91acabc1498611ed8ccc53f0610baefc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/mediatek/mt76/mt7921/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-68194 NVD
Published Date: 08/10/2026 NVD
Last Modified: 08/19/2026
Source: kernel.org
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
