CVE-2026-68311 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: guard link STA in decap offload
mt7925_sta_set_decap_offload() iterates over the vif valid_links mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of the vif, so mt792x_sta_to_link() can return NULL for a link that belongs to the vif but not to the station.
The function currently dereferences mlink before checking whether the link WCID is ready. If mlink is NULL, setting or clearing MT_WCID_FLAG_HDR_TRANS dereferences a NULL pointer.
Skip links without a station link before touching mlink->wcid.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists in the mt7925 wireless driver within the Linux kernel's mac80211 subsystem, specifically affecting Multi-Link Operation (MLO) station management during decapsulation offload configuration. The issue stems from improper handling of station link states when iterating through virtual interface valid_links mask, creating a potential null pointer dereference condition that could lead to system instability or privilege escalation.
The technical flaw occurs in the mt7925_sta_set_decap_offload() function where the driver attempts to process all valid links associated with a virtual interface without first verifying whether the corresponding station link exists for each valid link. When mt792x_sta_to_link() returns NULL for a particular link that belongs to the vif but not to the specific station, the subsequent code dereferences mlink before performing null checks, directly accessing memory through a NULL pointer reference.
This vulnerability represents a classic implementation error where the driver fails to properly validate pointer states before dereferencing, creating a condition that could be exploited by malicious actors to cause kernel panics or potentially gain elevated privileges. The flaw specifically affects the MT_WCID_FLAG_HDR_TRANS flag manipulation which controls header transformation offload capabilities in the wireless hardware.
The operational impact of this vulnerability extends beyond simple system crashes as it could allow attackers with local access to potentially escalate privileges through kernel memory corruption. When the driver encounters a NULL mlink pointer during decapsulation offload state updates, the system may experience immediate termination or exhibit unpredictable behavior due to invalid memory access patterns that violate kernel security boundaries.
According to CWE classification, this vulnerability maps to CWE-476 NULL Pointer Dereference, representing a fundamental programming error where null pointer validation is omitted before pointer usage. The ATT&CK framework would categorize this under privilege escalation techniques through kernel vulnerabilities, specifically targeting the kernel's network subsystem management functions. The fix implements proper null checking before accessing mlink->wcid, ensuring that only valid station links are processed during decapsulation offload configuration.
Mitigation strategies include applying the kernel patch that introduces conditional checks for NULL link pointers before attempting to access their associated WCID structures. System administrators should prioritize updating affected Linux kernel versions to prevent exploitation, particularly in environments where wireless networking is critical and local privilege escalation risks are significant. The fix aligns with secure coding practices by implementing proper null pointer validation as a defensive programming measure against common kernel vulnerabilities that could compromise system integrity through improper resource management.