CVE-2026-99060 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7603: initialize global station WCID
mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init().
Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer.
Initialize the WCID before publishing it.
The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's mt76 wireless driver for MT7603 hardware stems from an improper initialization sequence of a global station Wireless Context Identifier (WCID). In this specific subsystem, frames that do not belong to a defined station or virtual interface, such as those injected through monitor interfaces, are routed using a driver-private global WCID. While the core infrastructure initializes certain WCIIDs via mt76_register_device(), this particular private WCID was published and made available for use without being passed to the mandatory initialization function mt76_wcid_init(). This omission leaves critical data structures within the WCID in an undefined state, specifically leaving internal queue heads uninitialized.
The operational impact of this flaw became apparent following a change introduced by commit 0335c034e726, which modified how transmission queues are handled to fix race conditions related to checking tx queue fill status. Under the new logic, every frame associated with an unassociated station or virtual interface is queued onto the WCID's pending or off-channel transmission lists using __skb_queue_tail(). Because the global WCID was never initialized via mt76_wcid_init(), its internal sk_buff_head structures remain null. Consequently, when the first such frame is processed, the queueing function attempts to link a new element into an uninitialized list by dereferencing a NULL prev pointer. This results in a kernel oops or system reset due to invalid memory access during packet transmission processing.
From a technical classification perspective, this issue aligns with CWE-457, which describes the use of an uninitialized variable. The lack of proper initialization leads directly to undefined behavior when the driver attempts to manage network buffers associated with monitor mode traffic injection. This type of error is particularly dangerous in kernel space as it can lead to immediate denial of service through a system crash or potentially be exploited for further privilege escalation if the memory corruption allows control over execution flow, although the primary observed impact here is stability failure during specific packet handling scenarios.
The mitigation involves ensuring that all driver-private WCIIDs are fully initialized before they are published and made accessible to the transmission path. By calling mt76_wcid_init on the global station WCID prior to its use, the internal sk_buff_head structures are properly set up with valid pointers. Testing of this fix confirms that injecting wildcard probe requests through a monitor interface no longer triggers kernel panics or hardware resets. The system correctly advances queue heads and tails, allowing frames to be transmitted over the air as expected. Furthermore, normal operational traffic, such as large data transfers in access point mode, continues to function without interruption, verifying that the fix resolves the specific race condition without introducing regressions in standard network operations.