{"apiVersion":"1.0","identifier":"CVE-2026-99060","description":"In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit 0335c034e726 (-wifi: mt76: fix race condition related to checking tx queue fill status-), mt76_tx() queues every such frame on the WCID-s tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer. Initialize the WCID before publishing it. The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.","publishedAt":"2026-10-23T13:17:29","lastModifiedAt":"2026-10-23T13:17:29","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99060","cvssScore":null,"cvssVector":null,"epssProbability":0.00168,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99060","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99060","en":"https://www.redsauce.net/en/cves/CVE-2026-99060","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99060","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99060","de":"https://www.redsauce.net/de/cves/CVE-2026-99060","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99060","el":"https://www.redsauce.net/el/cves/CVE-2026-99060"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99060"}}