{"id":"CVE-2026-98958","kind":"vulnerability","aliases":["CVE-2026-98958"],"related":[],"title":"Linux kernel: Wi-Fi mt76 driver can stall MLO stations via counter drift","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: account non-AQL frames per peer rather than per link\n\nThe driver increments wcid->non_aql_packets when a frame goes to the\nhardware queue. The completion path decrements the counter again.\n\nFor an MLO peer, the hardware reports the completion on the link that it\nused for the transmission. This link can differ from the link that the\ndriver queued the frame on. In that case, the increment and the\ndecrement go to different link wcids, and the count drifts upwards until\nit blocks the station.\n\nKeep the count on the wcid of the primary link, like the other peer-wide\nstate.","summary":"In the Linux kernel's mt76 Wi-Fi driver, frames sent on one link of a multi-link (MLO) peer can be counted against a different link than the one that completes them, so the counter drifts upward until the station is blocked. The sources describe a denial-of-service effect on wireless traffic, not code execution.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","mlo","mt76","runtime","wifi-7"],"not_affected_if":["no-mlo-peers","no-mt76-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the mt76 fix \"account non-AQL frames per peer rather than per link\" (the fixed version is not given in the sources)","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:47+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:57:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the mt76 fix \"account non-AQL frames per peer rather than per link\" (the fixed version is not given in the sources)","reach":"network","title":"Linux kernel: Wi-Fi mt76 driver can stall MLO stations via counter drift","impact":"low","summary":"In the Linux kernel's mt76 Wi-Fi driver, frames sent on one link of a multi-link (MLO) peer can be counted against a different link than the one that completes them, so the counter drifts upward until the station is blocked. The sources describe a denial-of-service effect on wireless traffic, not code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","mt76","wifi-7","mlo"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Wireless station stops passing traffic; denial of service on Wi-Fi link","analyst_note":"Find the fixed kernel version and affected range in the NVD entry or the upstream kernel commit for the mt76 non-AQL per-peer change.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-mt76-hardware","no-mlo-peers"],"who_is_affected":"Systems running a Linux kernel with the mt76 Wi-Fi driver and MLO-capable peers, such as MediaTek-based Wi-Fi 7 hardware on Linux access points or clients. Systems without mt76 hardware, or without multi-link Wi-Fi, are unlikely to be affected. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000638,"input_tokens":3423,"output_tokens":591,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-7':28B '-98958':17A,20A 'account':101C 'aql':104C,117C 'block':73B,186C 'case':168C 'code':87B 'complet':62B,128C,142C 'count':53B,181C,191C 'counter':13A,66B,132C 'cve':15A,18A 'decrement':130C,173C 'denial':79B 'denial-of-servic':78B 'describ':76B 'differ':56B,155C,176C 'drift':14A,67B,182C 'driver':7A,38B,113C,161C 'effect':82B 'execut':88B 'fi':5A,37B 'follow':94C 'frame':39B,105C,121C,164C 'go':174C 'goe':122C 'hardwar':125C,139C 'increment':114C,170C 'keep':189C 'kernel':2A,23B,32B,92C 'like':199C 'link':43B,48B,57B,111C,145C,153C,158C,177C,198C 'linux':1A,22B,31B,91C 'linux-kernel':21B 'mlo':10A,24B,49B,136C 'mt76':6A,25B,34B,100C 'multi':47B 'multi-link':46B 'non':103C,116C 'non-aql':102C 'one':42B,60B 'packet':118C 'path':129C 'peer':50B,107C,137C,203C 'peer-wid':202C 'per':106C,110C 'primari':197C 'queu':162C 'queue':126C 'rather':108C 'report':140C 'resolv':98C 'runtim':26B 'sent':40B 'servic':81B 'sourc':75B 'stall':9A 'state':205C 'station':11A,71B,188C 'traffic':85B 'transmiss':151C 'upward':68B,183C 'use':148C 'via':12A 'vulner':95C 'wcid':115C,178C,194C 'wi':4A,36B 'wi-fi':3A,35B 'wide':204C 'wifi':27B,99C 'wireless':84B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mt76 Wi-Fi driver and MLO-capable peers, such as MediaTek-based Wi-Fi 7 hardware on Linux access points or clients. Systems without mt76 hardware, or without multi-link Wi-Fi, are unlikely to be affected. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98958","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98958","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98958","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}