CVE-2026-99060 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of affected kernel versions should assess exposure and apply patches. Operators managing Linux systems with mt7603 devices, security teams evaluating vulnerability impact, and platform owners verifying patch deployment are also impacted. Vulnerability management teams should prioritize patching based on asset inventory and risk assessment.

Why it matters

CVE-2026-99060 is a vulnerability in the Linux kernel's wifi mt76 driver for mt7603 devices. It can cause a system crash or reset due to a NULL pointer dereference when handling frames injected through a monitor interface. Linux kernel maintainers, Linux distribution vendors, and users of affected kernel versions should assess exposure and apply patches to prevent potential system instability and security risks.

• System crash or reset due to NULL pointer dereference.
• Potential for packet injection through monitor interfaces.
• Verification of patch application required for affected kernel versions.
• Possible impact on network stability and device availability.

Technical summary

The Linux kernel's wifi mt76 driver for mt7603 devices uses an uninitialized global station WCID for frames without a station or vif, leading to a NULL pointer dereference when injected through a monitor interface. The fix initializes the WCID before publishing it, preventing system crashes or resets due to NULL pointer dereferences. This vulnerability affects Linux kernel versions using the mt7603 driver and allows for potential packet injection through monitor interfaces. Maintainers and users should assess exposure and apply patches to prevent potential system instability and security risks.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to initialize the global station WCID.
• Monitor Linux kernel updates for affected versions and apply fixes as necessary.
• Restrict access to monitor interfaces to prevent packet injection.
• Verify system stability after applying patches.
• Perform vulnerability assessment to identify potential exposure.
• Inventory affected systems for prioritized patching.
• Track patch deployment and verify fixes.

Evidence notes

The vulnerability was introduced in specific Linux kernel commits and affects various kernel versions. The fix was tested on an MT7603 PCIe device through packet injection and file transfers without causing a system reset.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.