CVE-2026-63832
- Source
- https://cve.org/CVERecord?id=CVE-2026-63832
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63832.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-63832
- Downstream
BELL (1)
DEBIAN (1)
MGASA (1)
openSUSE (1)
- Related
- Published
- 2026-07-19T12:02:24Z
- Modified
- 2026-10-08T02:51:28Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- wifi: mt76: add wcid publish check in mt76_sta_add
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: add wcid publish check in mt76_sta_add
Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list.
Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself.
wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).
mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63832.json" }- References
-
- https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e
- https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e
- https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63832.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-63832
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4911e4cb157cf87d5bdb3fa8e0c200032443371eFixed3c499851753a24d2e148d4e9ca51764c0c51554eFixed55e014aaec650ede08b693ba59c8d0443f13f11cFixed20b126920a259df4d7dcae19fcfe2c57a74d6b2e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.13Fixed6.13
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.13.2Fixed6.14
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc9389e3f9453ec2d710e61830eafedddfd561226
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced57d3f833087942ded1a8765b1b361454d3d39e8f