High 8.8Published Jul 19, 2026

CVE-2026-63832wifi: mt76: add wcid publish check in mt76_sta_add

Updated under an hour ago (Oct 28, 2026, 12:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-662
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c9389e3f9453ec2d710e61830eafedddfd561226 before 720f39a9c60fdb604291c630f4f157753b376d68; 4911e4cb157cf87d5bdb3fa8e0c200032443371e builds before 3c499851753a24d2e148d4e9ca51764c0c51554e; 4911e4cb157cf87d5bdb3fa8e0c200032443371e builds before 55e014aaec650ede08b693ba59c8d0443f13f11c; 4911e4cb157cf87d5bdb3fa8e0c200032443371e builds before 20b126920a259df4d7dcae19fcfe2c57a74d6b2e; 57d3f833087942ded1a8765b1b361454d3d39e8f; from 6.12.13 before 6.12.114; from 6.13.2 before 6.14	CNA record
linux linux_kernel linux:linux_kernel	from 6.12.13 before 6.12.114; from 6.13.2 before 6.18.38; from 6.19 before 7.1.3	NVD

References

References

https://git.kernel.org/stable/c/720f39a9c60fdb604291c630f4f157753b376d68	patch
https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e	patch
https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c	patch
https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.