Is there a patch available for CVE-2026-99060?

Yes, a patch is available for CVE-2026-99060. Update the affected software to the latest version immediately.

Linux CVE-2026-99060

EUVD-2026-108726

2026-10-23 Linux

GHSA-88mv-32mf-f27j

Linux Code Injection

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7603: initialize global station WCID

mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init().

Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer.

Initialize the WCID before publishing it.

The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.

Affected VersionsENISA

Linux patch: 0

Linux patch: 7.3

Linux 6.7

Linux patch: 6.18.57

Linux 0335c034e7265d36d956e806f33202c94a8a9860 <e454ec553996f21085657c96c8a605e2d89a81a6

Linux 0335c034e7265d36d956e806f33202c94a8a9860 <dd117d17e8aa2e89f857fb708e5b770709fb81cb

Linux 0335c034e7265d36d956e806f33202c94a8a9860 <19d6fa087dcf242223645828b8282d4040bad168

Linux 0335c034e7265d36d956e806f33202c94a8a9860 <456de496b53ae73e6e3020fec815dbdc88aa7c07

Linux patch: 7.2.11

Linux patch: 6.12.113

Linux 6.6.48 <6.6.160

Linux d2defcddfe90b3be0cfccc2482495ab1fb759586 <99b8bd6323e6fc69615af828522878b7acb77bff

Linux patch: 6.6.160

Affected Packages

euvd linux fix: 6.6.160

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 23, 2026 - 13:17 EUVD

CVE Published

Oct 23, 2026 - 12:22 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Data Quality

2 sources

Confidence: Low

EUVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.