CVE-2025-68360 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wed_hif2 (e.g. 6GHz link).
[ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a
[ 297.464928] Mem abort info:
[ 297.467722] ESR = 0x0000000096000005
[ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits
[ 297.476766] SET = 0, FnV = 0
[ 297.479809] EA = 0, S1PTW = 0
[ 297.482940] FSC = 0x05: level 1 translation fault
[ 297.487809] Data abort info:
[ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000
[ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000
[ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP
[ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0
[ 297.723908] Tainted: [O]=OOT_MODULE
[ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT)
[ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table]
[ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76]
[ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80
[ 297.757126] sp : ffffffc080fe3ae0
[ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7
[ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00
[ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018
[ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000
[ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000
[ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da
[ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200
[ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002
[ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000
[ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8
[ 297.831686] Call trace:
[ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76]
[ 297.839254] mtk_wed_flow_remove+0x58/0x80
[ 297.843342] mtk_flow_offload_cmd+0x434/0x574
[ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40
[ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table]
[ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table]
[ 297.864463] process_one_work+0x174/0x300
[ 297.868465] worker_thread+0x278/0x430
[ 297.872204] kthread+0xd8/0xdc
[ 297.875251] ret_from_fork+0x10/0x20
[ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421)
[ 297.884901] ---[ end trace 0000000000000000 ]---
Fix the issue detecting the proper wed reference to use running wed callabacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/25/2025
The vulnerability CVE-2025-68360 affects the Linux kernel's mt76 wireless driver, specifically within the WiFi offload mechanisms for the MT7996 chip. This flaw manifests when the driver attempts to use the wrong reference in its WED (Wireless Engine Driver) callback functions, leading to a kernel memory access violation. The issue is particularly critical when operating in 6GHz frequency bands where the hardware may utilize the wed_hif2 device instead of the standard primary wed device. The improper reference handling causes a data abort exception during memory read operations, resulting in a kernel oops and system crash. The error trace shows the failure occurring in the mt76_wed_offload_disable function, which attempts to access memory at address 0x000000000000080a, an invalid location that triggers the kernel's memory management subsystem to panic. This vulnerability directly impacts systems using MediaTek MT7996 wireless hardware in configurations that enable WED offloading features, particularly those operating in the 6GHz spectrum where the alternative wed_hif2 device is required for proper operation.
The technical root cause stems from incorrect device reference management within the driver's callback mechanism. The mt76 driver maintains two distinct WED device types: the primary WED device and the wed_hif2 device, which serves as an alternative offload path. The flaw occurs because the driver's callback functions assume the primary WED device is always active, without properly detecting which device type is currently in use. This mismatch leads to the driver attempting to access data structures associated with the wrong device context, causing the kernel to dereference invalid memory addresses. The problem is classified as a memory access violation that falls under CWE-125: Out-of-bounds Read, as the driver reads from memory locations that are not properly allocated or accessible. The vulnerability is further characterized by its potential to cause system instability and denial of service, as the kernel panic prevents normal operation of the wireless subsystem. The crash occurs during network flow rule removal operations, indicating that the issue is triggered by network traffic management processes rather than simple device initialization.
The operational impact of this vulnerability extends beyond immediate system crashes to encompass broader network reliability concerns. When systems utilizing MT7996 wireless hardware encounter this flaw, they may experience unexpected reboots or complete network service outages, particularly in enterprise environments where continuous wireless connectivity is critical. The vulnerability affects both the 5GHz and 6GHz frequency bands, but the crash is more likely to occur in 6GHz scenarios where the wed_hif2 device is required. From an attack perspective, this vulnerability could be exploited to cause persistent denial of service, especially in network infrastructure devices such as access points or routers that rely on WED offloading for performance optimization. The error trace indicates the issue occurs within the network flow table subsystem, suggesting that attackers could potentially trigger the vulnerability through specific traffic patterns or by manipulating network flow rules. The crash occurs in kernel space, meaning that exploitation could potentially allow for privilege escalation or system compromise, though the direct attack surface is limited to the specific hardware and driver configuration.
Mitigation strategies for CVE-2025-68360 should focus on applying the kernel patch that properly detects and uses the correct WED reference in callback functions. System administrators should prioritize updating to kernel versions that include the fix, particularly those containing the corrected mt76 driver code that properly handles both WED device types. The patch ensures that the driver correctly identifies whether to use the primary WED device or the wed_hif2 device based on the current hardware configuration and operating mode. For systems where immediate kernel updates are not feasible, monitoring network flow table operations and implementing robust error handling in network infrastructure can help detect and recover from potential crashes. Additionally, administrators should consider disabling WED offloading features temporarily if the system does not require the performance benefits, though this may impact wireless throughput. The fix aligns with ATT&CK technique T1489: Service Stop, as it addresses a vulnerability that can cause system service interruptions through kernel-level crashes. Organizations should also implement proper system monitoring to detect early signs of memory corruption or kernel panics that may indicate this vulnerability's exploitation, ensuring that network availability remains intact during the remediation process.