github - ghsa-826h-4v2p-vwp5

ghsa-826h-4v2p-vwp5

Vulnerability from github

Published

2025-12-24 15:30

Modified

2025-12-24 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()

If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move the location of the queue params to within struct mt7996_vif_link.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-68738"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-24T13:16:28Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()\n\nIf a link does not have an assigned channel yet, mt7996_vif_link returns\nNULL. We still need to store the updated queue settings in that case, and\napply them later.\nMove the location of the queue params to within struct mt7996_vif_link.",
  "id": "GHSA-826h-4v2p-vwp5",
  "modified": "2025-12-24T15:30:43Z",
  "published": "2025-12-24T15:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68738"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/96841352aaba7723c20afb3a5356746810ef8198"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b8f34c1c5c4f5130c20e3253c95ba1d844d402b9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2025-68738 (GCVE-0-2025-68738)

Vulnerability from cvelistv5

Published

2025-12-24 12:09

Modified

2025-12-24 12:09

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move the location of the queue params to within struct mt7996_vif_link.

References

URL

Tags

	https://git.kernel.org/stable/c/96841352aaba7723c20afb3a5356746810ef8198
	https://git.kernel.org/stable/c/b8f34c1c5c4f5130c20e3253c95ba1d844d402b9
	https://git.kernel.org/stable/c/79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52

Impacted products

Vendor

Product

Version

Version: c0df2f0caa8dde0d50f36649ee28a54c5079281b
Version: c0df2f0caa8dde0d50f36649ee28a54c5079281b
Version: c0df2f0caa8dde0d50f36649ee28a54c5079281b

Version: 6.14

Show details on NVD website

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/main.c",
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c",
            "drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96841352aaba7723c20afb3a5356746810ef8198",
              "status": "affected",
              "version": "c0df2f0caa8dde0d50f36649ee28a54c5079281b",
              "versionType": "git"
            },
            {
              "lessThan": "b8f34c1c5c4f5130c20e3253c95ba1d844d402b9",
              "status": "affected",
              "version": "c0df2f0caa8dde0d50f36649ee28a54c5079281b",
              "versionType": "git"
            },
            {
              "lessThan": "79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52",
              "status": "affected",
              "version": "c0df2f0caa8dde0d50f36649ee28a54c5079281b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/main.c",
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c",
            "drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19-rc1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()\n\nIf a link does not have an assigned channel yet, mt7996_vif_link returns\nNULL. We still need to store the updated queue settings in that case, and\napply them later.\nMove the location of the queue params to within struct mt7996_vif_link."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-24T12:09:36.449Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96841352aaba7723c20afb3a5356746810ef8198"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8f34c1c5c4f5130c20e3253c95ba1d844d402b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52"
        }
      ],
      "title": "wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68738",
    "datePublished": "2025-12-24T12:09:36.449Z",
    "dateReserved": "2025-12-24T10:30:51.029Z",
    "dateUpdated": "2025-12-24T12:09:36.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.