CVE-2026-68310 PUBLISHED

wifi: mt76: mt7915: guard HE capability lookups

Assigner: Linux
Reserved: 30.07.2026 Published: 10.08.2026 Updated: 10.08.2026

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: guard HE capability lookups

mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() both run after checking HE support, then dereference the HE PHY capability returned by mt76_connac_get_he_phy_cap(). That helper can return NULL when no capability entry matches the vif type.

Fetch the capability before appending the TLV and skip the HE-specific setup when no matching capability is available.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from e6d557a78b6016eee7b9cd6832343efd32cc0b27 to 23a2b98e754da04e0e90314d5fa8ca44349590fb (excl.)
  • affected from e6d557a78b6016eee7b9cd6832343efd32cc0b27 to a031f454f14e3e76ad03bcb23918e1a82b4b0869 (excl.)
  • affected from e6d557a78b6016eee7b9cd6832343efd32cc0b27 to 871549814eb4da081f1e93cc0c7ea626a310a966 (excl.)
  • affected from e6d557a78b6016eee7b9cd6832343efd32cc0b27 to 6f99a5667c6c7c3e0da1d3c4dc8dfb103042609e (excl.)
  • affected from e6d557a78b6016eee7b9cd6832343efd32cc0b27 to 8e9db062654a388d0fa587acbeeae68dd33eba41 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.18 is affected
  • unaffected from 0 to 5.18 (excl.)
  • unaffected from 6.6.148 to 6.6.* (incl.)
  • unaffected from 6.12.101 to 6.12.* (incl.)
  • unaffected from 6.18.42 to 6.18.* (incl.)
  • unaffected from 7.1.6 to 7.1.* (incl.)
  • unaffected from 7.2-rc5 to * (incl.)

References