CVE-2026-99060wifi: mt76: mt7603: initialize global station WCID
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer. Initialize the WCID before publishing it. The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.
Timeline
ID reserved
By Linux
- 28 days later
· 28 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected d2defcddfe90b3be0cfccc2482495ab1fb759586 – < 99b8bd6323e6fc69615af828522878b7acb77bff
- affected 0335c034e7265d36d956e806f33202c94a8a9860 – < e454ec553996f21085657c96c8a605e2d89a81a6
- affected 0335c034e7265d36d956e806f33202c94a8a9860 – < dd117d17e8aa2e89f857fb708e5b770709fb81cb
- affected 0335c034e7265d36d956e806f33202c94a8a9860 – < 19d6fa087dcf242223645828b8282d4040bad168
- affected 0335c034e7265d36d956e806f33202c94a8a9860 – < 456de496b53ae73e6e3020fec815dbdc88aa7c07
- affected 6.6.48 – < 6.6.160
- affected 6.7
- unaffected < 6.7
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.11 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff (opens in a new tab)
- https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6 (opens in a new tab)
- https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb (opens in a new tab)
- https://git.kernel.org/stable/c/19d6fa087dcf242223645828b8282d4040bad168 (opens in a new tab)
- https://git.kernel.org/stable/c/456de496b53ae73e6e3020fec815dbdc88aa7c07 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-108726 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99060)Record last updated .