---
cve: "CVE-2026-68307"
severity: "LOW"
cvss: 3.1
epss: "17%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-08-10 13:20:20"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-12T06:35:35+02:00"
---

# CVE-2026-68307

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: fix crash in reset link replay

During reset recovery, mt7925_vif_connect_iter() replays firmware state
for links tracked in mvif->valid_links. After MLO link changes or MCU
timeout recovery, the driver bitmap can temporarily contain a link whose
mac80211 bss_conf has already gone away.

This can pass a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), matching
the crash where x1, the second argument, is NULL:

pc : mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib]
lr : mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common]
x2 : ffffff80a77f6018 x1 : 0000000000000000 x0 : ffffff8099402080
Call trace:
mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib]
mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common]
mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common]

Skip missing bss_conf entries before replaying the link. Non-MLO AP/STA
reset replay is unchanged because the helper still returns &vif->bss_conf
for the legacy link.

## Patch verfügbar (OSV)

- Kernel ≥ 6.12.101
- Kernel ≥ 6.18.42
- Kernel ≥ 7.1.6

## Referenzen

- <https://git.kernel.org/stable/c/d9326796a378f80be5f9fd60983c62fdccdf2f0b>
- <https://git.kernel.org/stable/c/95b0cf02731c74e073ef8937f5526bd4442a0326>
- <https://git.kernel.org/stable/c/89d03bda560d635f66d495f37b46a187fd4edfdf>
- <https://git.kernel.org/stable/c/bd8b2ec838184236c3fcbf738a926328836adf12>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-68307) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_