CVE-2026-80632

A flaw was found in the Linux kernel's Wi-Fi driver, specifically within the mt7996 component. When the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED configurations are enabled and the Airoha NPU System-on-Chip (SoC) is detected, the mt7996_init_tx_queues() function can attempt to dereference a NULL Wi-Fi/Ethernet Dispatcher (WED) pointer. This improper handling of the WED pointer during initialization can lead to system instability or a denial of service.

A moderate-impact NULL pointer dereference flaw was found in the Linux kernel's mt76 mt7996 Wi-Fi driver. When the MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED configuration options are enabled and the driver detects an Airoha NPU system-on-chip (SoC), the mt7996_init_tx_queues() function dereferences a NULL Wireless Ethernet Dispatcher (WED) pointer during transmit queue initialization, which can cause a kernel panic and result in a denial of service. The impact to Red Hat is rated Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are marked not affected for this flaw because the vulnerable code is not present in the shipped Red Hat kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.