GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63832 (GCVE-0-2026-63832)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
wifi: mt76: add wcid publish check in mt76_sta_add
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4911e4cb157cf87d5bdb3fa8e0c200032443371e , < 3c499851753a24d2e148d4e9ca51764c0c51554e (git)
Affected: 4911e4cb157cf87d5bdb3fa8e0c200032443371e , < 55e014aaec650ede08b693ba59c8d0443f13f11c (git)
Affected: 4911e4cb157cf87d5bdb3fa8e0c200032443371e , < 20b126920a259df4d7dcae19fcfe2c57a74d6b2e (git)
Affected: c9389e3f9453ec2d710e61830eafedddfd561226 (git)
Affected: 57d3f833087942ded1a8765b1b361454d3d39e8f (git)
Affected: 6.12.13 , < 6.13 (semver)
Affected: 6.13.2 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mac80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c499851753a24d2e148d4e9ca51764c0c51554e",
              "status": "affected",
              "version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
              "versionType": "git"
            },
            {
              "lessThan": "55e014aaec650ede08b693ba59c8d0443f13f11c",
              "status": "affected",
              "version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
              "versionType": "git"
            },
            {
              "lessThan": "20b126920a259df4d7dcae19fcfe2c57a74d6b2e",
              "status": "affected",
              "version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9389e3f9453ec2d710e61830eafedddfd561226",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "57d3f833087942ded1a8765b1b361454d3d39e8f",
              "versionType": "git"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mac80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: add wcid publish check in mt76_sta_add\n\nSince mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add\nto avoid reinitializing the wcid-\u003epoll_list.\n\nFound dev-\u003esta_poll_list corruption when using mt7925 and 7.1-rc4.\nAccording to the corruption information, prev-\u003enext was changed to itself.\n\nwlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2\nwlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)\nwlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)\n slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192\nlist_add corruption. prev-\u003enext should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).\n\n mt76_wcid_add_poll+0x95/0xd0 [mt76]\n mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]\n mt7925_rx_check+0xa7/0xc0 [mt7925_common]\n mt76_dma_rx_poll+0x50d/0x790 [mt76]\n mt792x_poll_rx+0x52/0xe0 [mt792x_lib]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached through WiFi RX/TX-status DMA processing and station add during 802.11 association/roaming, both triggered by frames from a peer on the same wireless segment. Per kernel WiFi guidance, frame-driven driver bugs are Adjacent, not Network.\nAC:L - An adjacent attacker can reliably create the race by sending deauth/association traffic to force sta re-add while flooding data frames to keep the RX poll path active; both sides of the race are attacker-influenced and repeatable.\nPR:N - Exploitation requires no Linux privileges\u2014only the ability to send 802.11 management/data frames as a nearby WiFi peer (rogue AP, deauth attacker, or associating client on AP mode), with no authentication to the victim host.\nUI:N - No victim user action is required beyond normal WiFi operation; deauth-forced roaming and automatic reassociation drive the vulnerable sta_add path without user interaction.\nS:U - Impact is kernel heap/list corruption within the same security authority; this is not a VM escape, IOMMU bypass, or cross-namespace boundary violation.\nC:H - Reinitializing an embedded list_head while still linked corrupts kernel linked-list metadata in kmalloc-backed structures; list corruption is memory corruption that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The corrupted doubly-linked list enables list-poisoning style arbitrary kernel writes and potential control-flow hijacking, not merely a bounded or transient modification.\nA:H - The reproducer triggers kernel list_add corruption detection and crash; corrupted sta_poll_list integrity can cause kernel panic/oops during normal WiFi operation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:41.271Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e"
        },
        {
          "url": "https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c"
        },
        {
          "url": "https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e"
        }
      ],
      "title": "wifi: mt76: add wcid publish check in mt76_sta_add",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63832",
    "datePublished": "2026-07-19T12:02:24.908Z",
    "dateReserved": "2026-07-19T07:54:57.015Z",
    "dateUpdated": "2026-08-17T04:51:41.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63832",
      "date": "2026-09-20",
      "epss": "0.00375",
      "percentile": "0.31394"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-20T14:43:34.000Z",
      "cve": "CVE-2026-63832",
      "id": "msrc_CVE-2026-63832",
      "initial_release_date": "2026-07-20T01:04:24.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mt76: add wcid publish check in mt76_sta_add",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63832.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mac80211.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c499851753a24d2e148d4e9ca51764c0c51554e",
                    "status": "affected",
                    "version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "55e014aaec650ede08b693ba59c8d0443f13f11c",
                    "status": "affected",
                    "version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "20b126920a259df4d7dcae19fcfe2c57a74d6b2e",
                    "status": "affected",
                    "version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c9389e3f9453ec2d710e61830eafedddfd561226",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "57d3f833087942ded1a8765b1b361454d3d39e8f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "affected",
                    "version": "6.12.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "affected",
                    "version": "6.13.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mac80211.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: add wcid publish check in mt76_sta_add\n\nSince mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add\nto avoid reinitializing the wcid-\u003epoll_list.\n\nFound dev-\u003esta_poll_list corruption when using mt7925 and 7.1-rc4.\nAccording to the corruption information, prev-\u003enext was changed to itself.\n\nwlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2\nwlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)\nwlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)\n slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192\nlist_add corruption. prev-\u003enext should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).\n\n mt76_wcid_add_poll+0x95/0xd0 [mt76]\n mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]\n mt7925_rx_check+0xa7/0xc0 [mt7925_common]\n mt76_dma_rx_poll+0x50d/0x790 [mt76]\n mt792x_poll_rx+0x52/0xe0 [mt792x_lib]"
          }
        ],
        "id": "CVE-2026-63832",
        "lastModified": "2026-08-17T05:17:21.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T12:16:56.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T07:24:06+00:00",
      "cve": "CVE-2026-63832",
      "id": "CVE-2026-63832",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: add wcid publish check in mt76_sta_add",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63832.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:58:50Z",
      "cve": "CVE-2026-63832",
      "id": "CVE-2026-63832",
      "initial_release_date": "2026-07-19T17:34:32Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "345",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63832",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63832.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.