{"id":"CVE-2026-99060","kind":"vulnerability","aliases":["CVE-2026-99060"],"related":[],"title":"Linux kernel: MediaTek MT7603 Wi-Fi driver crashes on injected monitor frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7603: initialize global station WCID\n\nmt7603 uses a driver-private global station WCID for frames that have\nneither a station nor a vif, including frames injected through a monitor\ninterface. Unlike the core global WCID initialized by\nmt76_register_device(), this WCID is published without ever being passed\nto mt76_wcid_init().\n\nSince commit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\"), mt76_tx() queues every such frame on the\nWCID's tx_pending or tx_offchannel queue and links its tx_list. The first\ninjected frame therefore reaches __skb_queue_tail() with an uninitialized\nsk_buff_head and dereferences a NULL prev pointer.\n\nInitialize the WCID before publishing it.\n\nThe fix was tested on an MT7603 PCIe device. Three wildcard probe requests\nwere injected through a monitor interface. The hardware queue head and tail\nadvanced from 0 to 3 and a second radio captured the third request over the\nair. No oops or reset occurred. After restoring AP mode, a 150 MB transfer\nalso completed without a reset.","summary":"In the Linux kernel's mt76 MediaTek MT7603 Wi-Fi driver, a global station WCID was published without initialization, so the first frame injected through a monitor interface dereferences a NULL pointer. The sources describe a kernel oops from that crash; they do not describe code execution.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mediatek-mt7603","mt76","wifi"],"not_affected_if":["driver-not-loaded","no-mt7603-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit initializing the mt7603 global station WCID (the commit id is not given in the sources).","status":"open","published_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:53:54+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:53:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit initializing the mt7603 global station WCID (the commit id is not given in the sources).","reach":"local","title":"Linux kernel: MediaTek MT7603 Wi-Fi driver crashes on injected monitor frames","impact":"medium","summary":"In the Linux kernel's mt76 MediaTek MT7603 Wi-Fi driver, a global station WCID was published without initialization, so the first frame injected through a monitor interface dereferences a NULL pointer. The sources describe a kernel oops from that crash; they do not describe code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","mediatek-mt7603","mt76"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel null pointer dereference crashes the machine","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-mt7603-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the mt76 MT7603 driver, which is used by MediaTek MT7603 PCIe Wi-Fi cards, and where a local user can inject frames through a monitor interface. Machines without MT7603 hardware or without this driver loaded can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3622,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99060':16A,19A '0':232C '0335c034e726':144C '150':256C '3':234C 'advanc':230C 'air':245C 'also':259C 'ap':253C 'buff':191C 'captur':239C 'check':152C 'code':75B 'commit':143C 'complet':260C 'condit':149C 'core':122C 'crash':9A,70B 'cve':14A,17A 'derefer':58B,194C 'describ':64B,74B 'devic':129C,213C 'driver':8A,40B,98C 'driver-priv':97C 'ever':135C 'everi':160C 'execut':76B 'fi':7A,39B 'fill':155C 'first':51B,179C 'fix':147C,206C 'follow':82C 'frame':13A,52B,104C,114C,162C,181C 'global':42B,91C,100C,123C 'hardwar':225C 'head':192C,227C 'includ':113C 'infrastructur':20B 'init':141C 'initi':48B,90C,125C,199C 'inject':11A,53B,115C,180C,219C 'interfac':57B,119C,223C 'kernel':2A,23B,32B,66B,80C 'link':174C 'linux':1A,22B,31B,79C 'linux-kernel':21B 'list':177C 'mb':257C 'mediatek':3A,25B,35B 'mediatek-mt7603':24B 'mode':254C 'monitor':12A,56B,118C,222C 'mt76':27B,34B,88C,127C,139C,146C,157C 'mt7603':4A,26B,36B,89C,94C,211C 'neither':107C 'null':60B,196C 'occur':250C 'offchannel':171C 'oop':67B,247C 'pass':137C 'pcie':212C 'pend':168C 'pointer':61B,198C 'prev':197C 'privat':99C 'probe':216C 'publish':46B,133C,203C 'queue':154C,159C,172C,185C,226C 'race':148C 'radio':238C 'reach':183C 'regist':128C 'relat':150C 'request':217C,242C 'reset':249C,263C 'resolv':86C 'restor':252C 'second':237C 'sinc':142C 'sk':190C 'skb':184C 'sourc':63B 'station':43B,92C,101C,109C 'status':156C 'tail':186C,229C 'test':208C 'therefor':182C 'third':241C 'three':214C 'transfer':258C 'tx':153C,158C,167C,170C,176C 'uniniti':189C 'unlik':120C 'use':95C 'vif':112C 'vulner':83C 'wcid':44B,93C,102C,124C,131C,140C,165C,201C 'wi':6A,38B 'wi-fi':5A,37B 'wifi':28B,87C,145C 'wildcard':215C 'without':47B,134C,261C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mt76 MT7603 driver, which is used by MediaTek MT7603 PCIe Wi-Fi cards, and where a local user can inject frames through a monitor interface. Machines without MT7603 hardware or without this driver loaded can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99060","severity":null,"published_at":"2026-10-23T13:17:29+00:00","modified_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99060","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99060","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}