CVE-2026-68194

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the RX worker when handling PKT TYPE TXRX NOTIFY events on non-mmio buses, such as USB and SDIO. The functions mt7921 rx check() and mt7921 queue rx skb() dispatch this event to mt7921 mac tx free(), which subsequently calls mt76 queue tx cleanup(). This process attempts to execute the tx cleanup() callback within queue ops; however, since this callback is only implemented for mmio queue operations and is NULL for USB and SDIO, the system triggers a kernel BUG.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.