CVE-2026-23363 is a medium severity vulnerability in the Linux kernel's mt76 wifi driver, specifically affecting the mt7925 chipset. The issue arises from a possible out-of-bounds access in the function mt7925_mac_write_txwi_80211(), where frame length was not properly checked before accessing management fields. This could lead to memory corruption and denial of service. The vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related variants. The vendor has released patches to address this issue, and users should update to fixed kernel versions. The vulnerability is part of a broader set of Linux kernel security fixes released by Ubuntu in July 2026.

Successful exploitation of this vulnerability could cause out-of-bounds memory access, potentially leading to denial of service (system crash or instability). The CVSS vector indicates local attack vector with low complexity and no user interaction required. Confidentiality impact is high, integrity impact is none, and availability impact is high. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should update their Linux kernel to versions 6.8.0-1064.72 or later (and corresponding patched versions) as provided by their Linux distribution vendor, such as Ubuntu. After applying the update, a system reboot is required to complete the remediation. Due to an ABI change in the kernel update, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions carefully to ensure full remediation.