CVE-2026-63866

A flaw was found in the Linux kernel's mt76 Wi-Fi driver for mt7996 devices. This vulnerability occurs when the mt7996_mac_sta_deinit_link() routine fails to properly clear a Wireless Client ID (WCID) pointer when removing a station link. This improper handling of the WCID pointer may lead to a resource management issue, potentially causing system instability or a denial of service.

An IMPORTANT severity flaw was found in the Linux kernel's mt76 Wi-Fi driver for MediaTek mt7996 (Wi-Fi 7) chipsets. The mt7996_mac_sta_deinit_link() routine does not clear the station's WCID (Wireless Client ID) pointer when a station link is removed, leaving a stale pointer that can later be observed by transmit, receive, or RCU-based lookup paths and used to access freed or reinitialized station state. This can result in a use-after-free condition that may cause a kernel panic and denial of service, with memory corruption possible in the worst case. All shipped Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS streams are currently marked not affected because the vulnerable code is not present: the affected mt76/mt7996 driver code is not built into Red Hat's shipped kernel packages. Upstream CVEORG rates this flaw 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while Red Hat rates it 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, IMPORTANT); as no shipped Red Hat product contains the vulnerable code, this severity difference has no practical consequence for Red Hat customers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.