Skip to main content

Linux Kernel CVE-2025-68360

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux
8.2
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach MT7996 device with WED+wed_hif2 offload
  2. Delivery
    Induce offloaded 6GHz flow lifecycle
  3. Exploit
    Flow teardown invokes mt76_wed_offload_disable
  4. Execution
    Callback dereferences wrong wed reference
  5. Persist
    Invalid memory read faults
  6. Impact
    Kernel Oops / device DoS

Vulnerability Assessment

Exploitation Conditions

Exploitation (a kernel crash) requires a MediaTek MT7996 (WiFi 7) deployment running the mt76 driver with WED hardware flow offload enabled AND traffic being offloaded via the secondary wed_hif2 engine - in practice a 6GHz link that binds the second WED instance. The limiting factors are significant: it does not affect systems without MT7996 hardware, without WED offload enabled, or that only use the primary wed engine; the fault is reached through the network flow-offload teardown path (nf_flow_table). These are non-default, hardware- and configuration-specific prerequisites, which sharply narrows the realistically exposed population despite the AV:N/AC:L/PR:N CVSS metrics.
Impact

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 8.2) rates this High, but the signals conflict with the technical reality. The corroborating intelligence points to low real-world risk: EPSS is 0.18% (8th percentile), there is no KEV listing, and no POC is referenced - only three kernel.org fix commits. More importantly, the AC:L and PR:N assignment overstates ease of exploitation: the crash only manifests on specific MediaTek MT7996 hardware that has WED hardware offload enabled AND is actively using the secondary wed_hif2 engine (e.g., a 6GHz link), which is a non-default, hardware-dependent condition rather than a universally reachable network flaw. The I:L in the vector is also questionable - the described impact is a kernel Oops (availability), with no evidence of integrity compromise. Net assessment: a legitimate stability/DoS bug for the narrow population running MT7996 + WED + wed_hif2, but not a broadly exploitable high-severity issue; the high CVSS is not matched by EPSS, KEV, or POC signals. Verify: CVSS claims network vector with low complexity, yet the bug is contingent on non-default hardware offload configuration - treat AC:L/PR:N with caution.
Exploit ScenarioDerived

On an MT7996-based router (e.g., Banana Pi BPI-R4) with WED offload enabled and a 6GHz link active, network flows are hardware-offloaded through the wed_hif2 engine; when an offloaded IPv6 flow is torn down (nf_flow_offload deletion), the driver disables offload using the wrong wed reference and the kernel Oopses, dropping the device. No public exploit code is referenced, and triggering is largely a byproduct of normal traffic/flow lifecycle on the affected configuration rather than a crafted remote payload, so an attacker would at most need to induce flow churn on a vulnerable device.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.

RemediationAI

Upstream fix available (three kernel.org stable commits: git.kernel.org/stable/c/385aab8fccd7a8746b9f1a17f3c1e38498a14bc7, .../ab94ecb997fd1bbc501a0116c7aad51556b67c86, .../d582d0e988d696698c94edf097062bb987ae592c); a specific released/tagged kernel version is not independently confirmed from the provided data, so update to a stable kernel release that includes these commits or apply the corresponding mt76 backport. As a compensating control where patching is not immediately possible, disable WED hardware offload for the mt76/MT7996 interface (module/DTS parameter, e.g. do not enable the wed offload path) - this eliminates the vulnerable callback path at the cost of losing hardware-accelerated forwarding throughput and higher CPU utilization; alternatively, avoid provisioning the 6GHz/second-band link that drives traffic onto wed_hif2, which is disruptive to 6GHz service. Since impact is a local kernel crash on affected router hardware rather than remote code execution, prioritize the kernel update during the next maintenance window for MT7996-based devices.

Affected ProductsAI

The vulnerability affects the Linux kernel mt76 wireless driver as used with MediaTek MT7996 (WiFi 7) chipsets when WED (Wireless Ethernet Dispatch) hardware flow offload is enabled and the secondary wed_hif2 engine is in use; the reproduction platform cited is the Banana Pi BPI-R4 running an out-of-tree mt76 module on kernel 6.12.50. No CPE strings were supplied in the intelligence, so exact affected version ranges are not enumerated by NVD data; the fix is delivered via kernel.org stable commits (385aab8fccd7a8746b9f1a17f3c1e38498a14bc7, ab94ecb997fd1bbc501a0116c7aad51556b67c86, d582d0e988d696698c94edf097062bb987ae592c), and any kernel/mt76 build predating those commits with MT7996+WED support should be considered affected until backport status is confirmed.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the mt76 driver in the Linux mac80211/nl80211 wireless stack, specifically MediaTek's MT7996 (WiFi 7) support combined with MediaTek Wireless Ethernet Dispatch (WED), a hardware offload path that accelerates packet forwarding between the wireless NIC and the SoC's Ethernet/network flow-offload (nf_flow_table) subsystem. The MT7996 can bind two offload engines - the primary 'wed' and a secondary 'wed_hif2' used for additional links such as 6GHz. The root cause is an incorrect object reference: mt76_wed_offload_disable() and related callbacks assumed the primary wed device rather than resolving the correct wed instance for the active hardware path, so when the offload flow lived on wed_hif2 the callback read from an unmapped address (level-1 translation fault at ~0x80a). This is effectively a CWE-476 (NULL/invalid pointer dereference) / CWE-825 (use of an invalid reference) class bug, though NVD lists CWE as N/A. The crash trace shows it firing from nf_flow_offload teardown (nf_flow_rule_route_ipv6 → mtk_wed_flow_remove → mt76_wed_offload_disable).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
vuln.today AI 5.9 MEDIUM

Crash needs specific MT7996+WED wed_hif2 configuration (AC:H); reachable via network flow offload without auth (PR:N); impact is availability-only kernel Oops, so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 4.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks

MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wed_hif2 (e.g. 6GHz link).

[ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a [ 297.464928] Mem abort info: [ 297.467722] ESR = 0x0000000096000005 [ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits [ 297.476766] SET = 0, FnV = 0 [ 297.479809] EA = 0, S1PTW = 0 [ 297.482940] FSC = 0x05: level 1 translation fault [ 297.487809] Data abort info: [ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000 [ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000 [ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP [ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0 [ 297.723908] Tainted: [O]=OOT_MODULE [ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT) [ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table] [ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80 [ 297.757126] sp : ffffffc080fe3ae0 [ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7 [ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00 [ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018 [ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000 [ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 [ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da [ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200 [ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002 [ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000 [ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8 [ 297.831686] Call trace: [ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.839254] mtk_wed_flow_remove+0x58/0x80 [ 297.843342] mtk_flow_offload_cmd+0x434/0x574 [ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40 [ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table] [ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table] [ 297.864463] process_one_work+0x174/0x300 [ 297.868465] worker_thread+0x278/0x430 [ 297.872204] kthread+0xd8/0xdc [ 297.875251] ret_from_fork+0x10/0x20 [ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421) [ 297.884901] ---[ end trace 0000000000000000 ]---

Fix the issue detecting the proper wed reference to use running wed callabacks.

Executive ViewAI

Why It Matters

The mt76 wireless driver in Linux kernels supporting MT7996 WiFi 7 hardware contains a denial-of-service vulnerability that can cause unexpected system crashes when processing multi-band network offload operations. Organizations with deployed WiFi 7 infrastructure using this driver may experience availability disruptions and unplanned system reboots. No vendor patch is currently available, requiring interim configuration changes to protect system stability.

Business Impact: High
Compensating Controls

Disable hardware-accelerated flow offloading on secondary wireless instances (6GHz/wed_hif2) through driver configuration. Deploy monitoring and alerting for kernel panic events to detect exploitation. Establish rapid system restart procedures to minimize downtime. Maintain current backups and incident response procedures.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
Low
MediaTek MT7996 WiFi 7 with WED offload; niche router/SoC hardware footprint
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/338227 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20555/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20570/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20599/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20615/ REF https://git.kernel.org/stable/c/369cdd236970f7ad95e47eb2d43dbc759288a636 REF https://git.kernel.org/stable/c/385aab8fccd7a8746b9f1a17f3c1e38498a14bc7 REF https://git.kernel.org/stable/c/ab94ecb997fd1bbc501a0116c7aad51556b67c86 REF https://git.kernel.org/stable/c/d582d0e988d696698c94edf097062bb987ae592c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy