CVE-2026-99060

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7603: initialize global station WCID

mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76 register device(), this WCID is published without ever being passed to mt76 wcid init().

Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76 tx() queues every such frame on the WCID's tx pending or tx offchannel queue and links its tx list. The first injected frame therefore reaches skb queue tail() with an uninitialized sk buff head and dereferences a NULL prev pointer.

Initialize the WCID before publishing it.

The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.