Executive brief
A vulnerability in the Linux kernel's MediaTek Wi-Fi driver (mt76) can cause a system crash when using high-speed 6GHz wireless links. This occurs because the driver incorrectly handles hardware offloading tasks, leading to an 'internal error' or 'oops' that halts the operating system. This issue primarily affects devices using MediaTek MT7996 wireless chips, such as certain high-performance routers and access points, potentially leading to a complete loss of network availability.
Technical details
A vulnerability exists in the mt76 wireless driver within the Linux kernel's Wireless Ethernet Dispatcher (WED) component. The MT7996 driver supports multiple WED instances (primary and hif2) for traffic offloading, but the callback implementation incorrectly assumed the use of the primary WED device. When operating on a 6GHz link using the secondary 'wed_hif2' interface, this logic error leads to an invalid memory read and a kernel panic (Oops). The fix involves implementing proper device reference detection in the WED driver callbacks to ensure the correct hardware interface is addressed. Patches have been released for various stable kernel branches including 6.12.y and 6.17.y.
Affected products
- Linux Linux Kernel 6.8 to 6.12.50
Timeline
- 2025-10-08: disclosed: Initial patch submitted by Lorenzo Bianconi
- 2025-12-18: patched: Patch committed to stable kernel tree
- 2025-12-24: advisory: CVE-2025-68360 published