{"id":"CVE-2026-99060","revision":null,"records":[{"revision":"5f98b4c4a15d424cb8dd30bbb5bd11da","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-99060","aliases":[],"title":"wifi: mt76: mt7603: initialize global station WCID","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7603: initialize global station WCID\n\nmt7603 uses a driver-private global station WCID for frames that have\nneither a station nor a vif, including frames injected through a monitor\ninterface. Unlike the core global WCID initialized by\nmt76_register_device(), this WCID is published without ever being passed\nto mt76_wcid_init().\n\nSince commit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\"), mt76_tx() queues every such frame on the\nWCID's tx_pending or tx_offchannel queue and links its tx_list. The first\ninjected frame therefore reaches __skb_queue_tail() with an uninitialized\nsk_buff_head and dereferences a NULL prev pointer.\n\nInitialize the WCID before publishing it.\n\nThe fix was tested on an MT7603 PCIe device. Three wildcard probe requests\nwere injected through a monitor interface. The hardware queue head and tail\nadvanced from 0 to 3 and a second radio captured the third request over the\nair. No oops or reset occurred. After restoring AP mode, a 150 MB transfer\nalso completed without a reset.","state":0,"publishedAt":"2026-10-23T12:22:49.164+00:00","modifiedAt":"2026-10-23T12:22:49.164+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/net/wireless/mediatek/mt76/mt7603/init.c\"\n ],\n \"versions\": [\n {\n \"version\": \"d2defcddfe90b3be0cfccc2482495ab1fb759586\",\n \"lessThan\": \"99b8bd6323e6fc69615af828522878b7acb77bff\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"0335c034e7265d36d956e806f33202c94a8a9860\",\n \"lessThan\": \"e454ec553996f21085657c96c8a605e2d89a81a6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"0335c034e7265d36d956e806f33202c94a8a9860\",\n \"lessThan\": \"dd117d17e8aa2e89f857fb708e5b770709fb81cb\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"0335c034e7265d36d956e806f33202c94a8a9860\",\n \"lessThan\": \"19d6fa087dcf242223645828b8282d4040bad168\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"0335c034e7265d36d956e806f33202c94a8a9860\",\n \"lessThan\": \"456de496b53ae73e6e3020fec815dbdc88aa7c07\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"6.6.48\",\n \"lessThan\": \"6.6.160\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/net/wireless/mediatek/mt76/mt7603/init.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.7\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.7\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.160\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.113\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.57\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.11\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff","https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6","https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb","https://git.kernel.org/stable/c/19d6fa087dcf242223645828b8282d4040bad168","https://git.kernel.org/stable/c/456de496b53ae73e6e3020fec815dbdc88aa7c07"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99060","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99060","identifiers":["CVE-2026-99060"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-28T07:08:14.3778977+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-28T07:08:14.3778977+00:00","lastSuccessAt":"2026-10-28T07:08:14.5491124+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:08:14.5491128+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d2186f400c54d65f61687f78bb1a00d184d2e215877d0194d7ed70caee809a44-0fadfda5ba4e8069002a7aa962e2f7d79794e912aa9e589d2adc25ac2577285a","complete":true,"records":415559,"lastAttemptAt":"2026-10-28T07:06:21.5829281+00:00","lastSuccessAt":"2026-10-28T07:06:21.5452151+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:06:21.5829281+00:00","snapshotPublishedAt":"2026-10-28T06:40:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1de1564061e94716a5c6ac7e9c6f3013","complete":false,"records":11690,"lastAttemptAt":"2026-10-28T07:20:12.9404081+00:00","lastSuccessAt":"2026-10-28T07:20:12.936+00:00","error":"18 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-28T07:20:12.936+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":6982,"expectedIdentifiers":13514,"failedIdentifiers":18},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-28T07:08:14.3778977+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-28T07:08:14.3778977+00:00","lastSuccessAt":"2026-10-28T07:08:14.5500766+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:08:14.550077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8d16a738328646698f9217d8ea11893c","complete":true,"records":13449,"lastAttemptAt":"2026-10-28T07:08:15.0871785+00:00","lastSuccessAt":"2026-10-27T22:48:29.491+00:00","error":null,"lastVerifiedAt":"2026-10-27T22:48:29.491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13514,"expectedIdentifiers":13514,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f7cb12508d9e6a348c8a60f772ed85529cc80cd2ff853da1099b57754b20e943","complete":true,"records":9790,"lastAttemptAt":"2026-10-28T07:08:14.232626+00:00","lastSuccessAt":"2026-10-27T21:49:03.9756799+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:08:14.232626+00:00","snapshotPublishedAt":"2026-10-27T21:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-28T07:06:21.7385741+00:00","lastSuccessAt":"2026-10-27T21:46:38.0277323+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:06:21.7385741+00:00","snapshotPublishedAt":"2026-10-27T21:18:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-28T07:08:14.3365383+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:08:14.3365383+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-cf3d7f231228fbafaf00b899a3529c24d9add8aab904e519be8d085668fa0c9c","complete":true,"records":230856,"lastAttemptAt":"2026-10-28T07:08:14.1053593+00:00","lastSuccessAt":"2026-10-28T07:08:12.8687117+00:00","error":null,"lastVerifiedAt":"2026-10-28T07:08:14.1053593+00:00","snapshotPublishedAt":"2026-10-28T06:48:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}