CVE-2026-74323 (GCVE-0-2026-74323)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb() If link_conf or link_sta lookup fails in mt7996_tx_prepare_skb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of error.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ef0c7ad735b0c38140259519a3f165bee2b857c , < 06e65d6cf80490bc0457d339595d1ed5a89e8899 (git)
Affected: 7ef0c7ad735b0c38140259519a3f165bee2b857c , < fa0e9aa92a7bc97fc42014c5efaaf1278fa92723 (git)
Affected: 7ef0c7ad735b0c38140259519a3f165bee2b857c , < 831074096d0450308357271fc0ffd3f600a2487e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mac.c",
            "drivers/net/wireless/mediatek/mt76/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "06e65d6cf80490bc0457d339595d1ed5a89e8899",
              "status": "affected",
              "version": "7ef0c7ad735b0c38140259519a3f165bee2b857c",
              "versionType": "git"
            },
            {
              "lessThan": "fa0e9aa92a7bc97fc42014c5efaaf1278fa92723",
              "status": "affected",
              "version": "7ef0c7ad735b0c38140259519a3f165bee2b857c",
              "versionType": "git"
            },
            {
              "lessThan": "831074096d0450308357271fc0ffd3f600a2487e",
              "status": "affected",
              "version": "7ef0c7ad735b0c38140259519a3f165bee2b857c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mac.c",
            "drivers/net/wireless/mediatek/mt76/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()\n\nIf link_conf or link_sta lookup fails in mt7996_tx_prepare_skb routine,\nmt7996 driver leaks an already allocated tx token. Fix the issue\nreleasing the token in case of error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The flaw is in mt7996 TX preparation for EAPOL frames on MLO stations; a nearby WiFi attacker can trigger WPA authentication/rekey traffic that drives this driver TX path on APs, routers, and clients using MediaTek mt7996 hardware.\nAC:L - An attacker can repeatedly initiate or tear down MLO associations and EAPOL exchanges to hit the narrow window where link_conf/link_sta are NULL during TX, reliably leaking tokens without depending on uncontrollable system state.\nPR:N - Exploitation requires only an unauthenticated adjacent WiFi peer initiating or disrupting MLO WPA handshakes that cause EAPOL transmission; no local account, capability, or init-namespace root access is needed on the victim.\nUI:N - No victim user action such as opening files or clicking prompts is required; the attacker alone can generate the authentication traffic needed to reach the vulnerable EAPOL TX path.\nS:U - Impact is confined to the kernel wireless subsystem on the affected host (token exhaustion and potential memory corruption); it does not cross VM, container, or IOMMU security boundaries.\nC:H - Leaked tokens leave stale idr entries pointing at txwi_cache structures that dma.c returns to the free pool, enabling reuse of the same cache while orphaned entries retain dangling skb pointers that can be dereferenced on later token operations.\nI:H - Reusing txwi_cache buffers still referenced by leaked token IDs can corrupt in-flight TX metadata and skb associations, providing a plausible path to controlled memory corruption and kernel code execution beyond simple resource loss.\nA:H - Each leak permanently consumes one of 16384 TX tokens; sustained triggering exhausts the pool, invokes __mt76_set_tx_blocked(), and halts all wireless transmission on the interface, constituting a repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:53.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/06e65d6cf80490bc0457d339595d1ed5a89e8899"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa0e9aa92a7bc97fc42014c5efaaf1278fa92723"
        },
        {
          "url": "https://git.kernel.org/stable/c/831074096d0450308357271fc0ffd3f600a2487e"
        }
      ],
      "title": "wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74323",
    "datePublished": "2026-08-15T05:58:18.857Z",
    "dateReserved": "2026-08-15T05:44:03.884Z",
    "dateUpdated": "2026-08-17T05:45:53.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74323",
      "date": "2026-09-21",
      "epss": "0.00239",
      "percentile": "0.15215"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7996/mac.c",
                  "drivers/net/wireless/mediatek/mt76/tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "06e65d6cf80490bc0457d339595d1ed5a89e8899",
                    "status": "affected",
                    "version": "7ef0c7ad735b0c38140259519a3f165bee2b857c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa0e9aa92a7bc97fc42014c5efaaf1278fa92723",
                    "status": "affected",
                    "version": "7ef0c7ad735b0c38140259519a3f165bee2b857c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "831074096d0450308357271fc0ffd3f600a2487e",
                    "status": "affected",
                    "version": "7ef0c7ad735b0c38140259519a3f165bee2b857c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7996/mac.c",
                  "drivers/net/wireless/mediatek/mt76/tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()\n\nIf link_conf or link_sta lookup fails in mt7996_tx_prepare_skb routine,\nmt7996 driver leaks an already allocated tx token. Fix the issue\nreleasing the token in case of error."
          }
        ],
        "id": "CVE-2026-74323",
        "lastModified": "2026-08-17T06:19:26.740",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:32.877",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/06e65d6cf80490bc0457d339595d1ed5a89e8899"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/831074096d0450308357271fc0ffd3f600a2487e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fa0e9aa92a7bc97fc42014c5efaaf1278fa92723"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T17:18:53+00:00",
      "cve": "CVE-2026-74323",
      "id": "CVE-2026-74323",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74323.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T00:58:48Z",
      "cve": "CVE-2026-74323",
      "id": "CVE-2026-74323",
      "initial_release_date": "2026-08-28T00:58:48Z",
      "product_status:known_not_affected": "290",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74323",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74323.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.