CVE-2026-68193

A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O (MMIO) specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit this vulnerability by sending specially crafted Wi-Fi packets, causing a system crash and resulting in a denial of service.

This issue affects MediaTek mt7925 on non-MMIO buses (e.g. USB). MMIO-only TXRX_NOTIFY events are dispatched to mt7925_mac_tx_free(), calling unsupported queue ops. Systems without mt7925 USB Wi-Fi are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the mt7925e module from loading. See https://access.redhat.com/solutions/41278 for instructions.