CVE-2026-68308
kernel: wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 10, 2026
Updated · August 31, 2026
Description
A flaw was found in the Linux kernel's Wi-Fi driver (mt76: mt7996). The mt76_connac_get_he_phy_cap() routine can theoretically return a null pointer, which is not properly checked before being dereferenced. This oversight could allow a local attacker to cause a denial of service (DoS) by triggering a system crash.
Statement
This issue affects MediaTek mt7996 Wi-Fi. HE PHY capability pointer from mt76_connac_get_he_phy_cap() is not checked for NULL before dereference. Systems without mt7996 hardware are not affected.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference