wifi: mt76: add wcid publish check in mt76_sta_add
Summary
| CVE | CVE-2026-63832 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-19 12:16:56 UTC |
| Updated | 2026-07-20 15:16:49 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib] |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.001550000 probability, percentile 0.050830000 (date 2026-07-20)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 4911e4cb157cf87d5bdb3fa8e0c200032443371e 3c499851753a24d2e148d4e9ca51764c0c51554e git | Not specified |
| CNA | Linux | Linux | affected 4911e4cb157cf87d5bdb3fa8e0c200032443371e 55e014aaec650ede08b693ba59c8d0443f13f11c git | Not specified |
| CNA | Linux | Linux | affected 4911e4cb157cf87d5bdb3fa8e0c200032443371e 20b126920a259df4d7dcae19fcfe2c57a74d6b2e git | Not specified |
| CNA | Linux | Linux | affected c9389e3f9453ec2d710e61830eafedddfd561226 git | Not specified |
| CNA | Linux | Linux | affected 57d3f833087942ded1a8765b1b361454d3d39e8f git | Not specified |
| CNA | Linux | Linux | affected 6.12.13 6.13 semver | Not specified |
| CNA | Linux | Linux | affected 6.13.2 6.14 semver | Not specified |
| CNA | Linux | Linux | affected 6.14 | Not specified |
| CNA | Linux | Linux | unaffected 6.14 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.38 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.3 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.