CVE-2026-68193

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the RX worker of the Linux kernel when handling PKT TYPE TXRX NOTIFY events on non-mmio buses, such as USB. The functions mt7925 rx check() and mt7925 queue rx skb() dispatch this event to mt7925 mac tx free(), which subsequently calls mt76 queue tx cleanup(). This process attempts to execute the tx cleanup() callback within queue ops; however, since only mmio queue operations implement this callback, it remains NULL on USB buses, leading to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.