What is the CVSS score of EUVD-2026-45550?

EUVD-2026-45550 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45550?

A high-severity flaw in the Linux kernel's MediaTek Wi-Fi driver (CVE-2026-63866) could enable denial-of-service or privilege escalation on affected systems via network-adjacent attack.. A patch is available.

How to fix or mitigate EUVD-2026-45550?

Within 24 hours, identify all Linux systems running the MediaTek mt76/mt7996 Wi-Fi driver and document their current kernel versions; cross-reference against CVE-2026-63866 affected kernel releases. Within 7 days, apply vendor-released kernel patches to all identified systems through your standard change management process, ensuring systems receive the stable kernel version containing the fix. Within 30 days, validate deployment completion, confirm absence of driver-related stability issues in system logs, and update vulnerability tracking records.

Linux Kernel EUVD-2026-45550

| CVE-2026-63866 HIGH

2026-07-19 Linux

GHSA-xhw4-f4c3-7c2f

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Adjacent wireless vector (AV:A) with a teardown race raising complexity to AC:H; no auth needed (PR:N); UAF yields memory disclosure (C:H) and instability (A:H), with limited integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:01 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine.

AnalysisAI

Memory-safety defect in the Linux kernel's MediaTek mt76/mt7996 Wi-Fi driver leaves a stale WCID (wireless client ID) pointer behind when a station link is torn down in mt7996_mac_sta_deinit_link(), creating a dangling reference that can be dereferenced after the underlying station object is freed. The fix, released in stable kernels, explicitly clears the WCID pointer during link deinitialization. The NVD-assigned CVSS of 8.8 (AV:A) rates this high, though no public exploit has been identified and EPSS exploitation probability is very low (0.15%, 5th percentile).

Technical ContextAI

The affected component is the mt7996 chipset driver within the mt76 mac80211 driver family, which supports MediaTek Wi-Fi 7 (802.11be) radios in the Linux kernel networking stack. WCIDs are per-station hardware indices the driver uses to map a connected wireless client to hardware queues and key material; the driver keeps a pointer table (dev->wcid) referencing station-context structures. When a station link is removed via mt7996_mac_sta_deinit_link() without clearing its WCID table entry, the table retains a pointer to memory that is subsequently freed. Any later hardware event, frame, or lookup that indexes that WCID slot dereferences freed memory - a classic dangling-pointer / use-after-free condition (CWE-416 class, though the CVE lists CWE as N/A). The upstream 'Information Disclosure' tag suggests the primary observed impact is reading freed/leaked kernel memory, but a UAF of this type can also corrupt kernel state.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.33, 7.0.10, or 7.1 (or your distribution's backport containing commits 455a48685feebf2d9c1656caad77f9ba1da7b06e / c575459b485c47615491b1fd29f04b43fdc3da56 / 88973240dc7c976dd320b36a9e6d925c9be083ae). Apply the kernel update and reboot, or reload the mt7996 module after patching. Where immediate patching is not possible, the practical compensating control is to unload/blacklist the mt76/mt7996 driver on affected hosts (disables MediaTek Wi-Fi entirely - acceptable on wired servers, disruptive on Wi-Fi-dependent endpoints), or disable the Wi-Fi radio and rely on wired/alternate connectivity to remove the adjacent attack surface. Reducing exposure to untrusted wireless networks (avoiding association with attacker-controlled APs and limiting range access) lowers the chance an attacker can trigger the station link teardown path. See advisories at git.kernel.org/stable and https://nvd.nist.gov/vuln/detail/CVE-2026-63866.