CVE-2026-68311

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: guard link STA in decap offload

mt7925stasetdecapoffload() iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of the vif, so mt792xstatolink() can return NULL for a link that belongs to the vif but not to the station.

The function currently dereferences mlink before checking whether the link WCID is ready. If mlink is NULL, setting or clearing MTWCIDFLAGHDRTRANS dereferences a NULL pointer.

Skip links without a station link before touching mlink->wcid.