8.8

CVE-2026-63832

wifi: mt76: add wcid publish check in mt76_sta_add

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: add wcid publish check in mt76_sta_add

Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add
to avoid reinitializing the wcid->poll_list.

Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4.
According to the corruption information, prev->next was changed to itself.

wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2
wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)
wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)
 slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192
list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).

 mt76_wcid_add_poll+0x95/0xd0 [mt76]
 mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]
 mt7925_rx_check+0xa7/0xc0 [mt7925_common]
 mt76_dma_rx_poll+0x50d/0x790 [mt76]
 mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 4911e4cb157cf87d5bdb3fa8e0c200032443371e
Version < 3c499851753a24d2e148d4e9ca51764c0c51554e
Status affected
Version 4911e4cb157cf87d5bdb3fa8e0c200032443371e
Version < 55e014aaec650ede08b693ba59c8d0443f13f11c
Status affected
Version 4911e4cb157cf87d5bdb3fa8e0c200032443371e
Version < 20b126920a259df4d7dcae19fcfe2c57a74d6b2e
Status affected
Version c9389e3f9453ec2d710e61830eafedddfd561226
Status affected
Version 57d3f833087942ded1a8765b1b361454d3d39e8f
Status affected
Version 6.12.13
Version < 6.13
Status affected
Version 6.13.2
Version < 6.14
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.14
Status affected
Version 0
Version < 6.14
Status unaffected
Version <= 6.18.*
Version 6.18.38
Status unaffected
Version <= 7.1.*
Version 7.1.3
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.13
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e
https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c
https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e