In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private… (CVE-2026-99060)

The Linux kernel mt7603 WiFi driver used a driver-private global station WCID for frames lacking a station or vif, including injected frames. Unlike the core global WCID, this WCID was published without initialization via mt76_wcid_init(). Since commit 0335c034e726, frames were queued on this WCID's tx_pending or tx_offchannel queue, leading to a NULL pointer dereference in __skb_queue_tail() due to an uninitialized sk_buff_head. The fix initializes the WCID before publishing, preventing kernel oops and resets. Testing on MT7603 PCIe hardware confirmed the fix's effectiveness with no crashes or resets during injected frames and normal AP mode operation.

The vulnerability could cause kernel crashes (NULL pointer dereference) when processing certain WiFi frames, potentially leading to denial of service on affected systems using the mt7603 driver. No evidence of exploitation in the wild is known.

A fix has been implemented that initializes the global station WCID before publishing it. Users should apply the updated Linux kernel version containing this fix to remediate the issue. No additional mitigation steps are indicated.