Executive brief
The Linux kernel's mt76 WiFi driver incorrectly triggers a kernel warning when processing corrupted network frames in monitor mode with failure frame capture enabled. An attacker can transmit malformed frames over the air to cause the warning, which can panic the entire system if panic-on-warn is enabled, resulting in a denial of service affecting any device running the vulnerable kernel.
Technical details
The vulnerability exists in the mt76x02_mac_process_rx() function where a WARN_ON_ONCE() macro wraps a bounds check on the MPDU length field received from WiFi hardware. In monitor mode with the fcsfail filter enabled, corrupted frames from the hardware can report frame lengths exceeding the received buffer size. While the bounds check correctly discards the frame, the WARN_ON_ONCE wrapper taints the kernel log and triggers a panic when panic_on_warn is set to 1. The fix removes the WARN_ON_ONCE wrapper, allowing frames to be silently discarded without kernel notification, similar to prior fixes in the rx and tx status paths (commit c2d4c8723dbf). Attack precondition is proximity to transmit corrupted frames over the air on a monitored WiFi channel; no authentication or special privileges required from the attacker.
Affected products
- Linux Linux kernel affected versions include at least linux-5.10.y through linux-6.9.y and later, introduced by commit 7bc04215a66b
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-06-12: patched: Upstream fix committed by Devin Wittmayer
- 2026-09-14: patched: Stable kernel releases published by Greg Kroah-Hartman