Skip to main content

Linux Kernel CVE-2026-63832

| EUVDEUVD-2026-45498 HIGH
2026-07-19 Linux GHSA-xq4q-93xc-52g2
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Adjacent WiFi radio access (AV:A); triggering depends on association/roaming timing (AC:H); no auth or interaction; evidence shows kernel panic so A:H with no confirmed confidentiality/integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:48 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 8.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: add wcid publish check in mt76_sta_add

Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list.

Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself.

wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).

mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]

AnalysisAI

Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).

Technical ContextAI

The affected component is the mt76 mac80211 driver framework in the Linux kernel and its mt7925 sub-driver (used for MediaTek MT7925 WiFi 6E/7 client adapters common in recent laptops). Each associated station is represented by a wcid (wireless client ID) structure that is linked into a per-device sta_poll_list to schedule statistics polling. The bug is a double-initialization / list-management error: mt7925_mac_sta_add already publishes the wcid and its poll_list node, but the generic mt76_sta_add path re-initializes wcid->poll_list, breaking the doubly-linked list invariant (the reported corruption shows prev->next pointing back to itself). Although no CWE was assigned in the input, this maps to the CWE-416 (use-after-free) / CWE-665 (improper initialization) / CWE-824 (access of uninitialized pointer) class of linked-list corruption bugs, with the concrete symptom being list_add corruption detected by the kernel's list debugging.

RemediationAI

Vendor-released patch: update to Linux kernel 6.18.38 or 7.1.3 (or mainline 7.2-rc1 or later), which add the wcid publish check in mt76_sta_add so the poll_list is not reinitialized; the corresponding stable commits are 3c499851753a24d2e148d4e9ca51764c0c51554e, 55e014aaec650ede08b693ba59c8d0443f13f11c, and 20b126920a259df4d7dcae19fcfe2c57a74d6b2e at git.kernel.org. Apply the distribution kernel update that incorporates these commits and reboot. Where immediate patching is not possible, the practical compensating control is to avoid using the affected MT7925 WiFi interface - unload or blacklist the mt7925 driver modules (mt7925_common/mt792x_lib/mt76) and use a wired connection or an alternative WiFi adapter, accepting the trade-off of losing wireless connectivity; reducing roaming between access points may lower the chance of triggering the association-time corruption but is not a reliable fix. Consult the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-63832 and your distribution's security tracker for backport availability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63832 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy