In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer. Initialize the WCID before publishing it. The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global     station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a     vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by     mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit     0335c034e726 (wifi: mt76: fix race condition related to checking tx queue fill status), mt76_tx() queues     every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected     frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev     pointer. Initialize the WCID before publishing it. The fix was tested on an MT7603 PCIe device. Three     wildcard probe requests were injected through a monitor interface. The hardware queue head and tail     advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset     occurred. After restoring AP mode, a 150 MB transfer also completed without a reset. (CVE-2026-99060)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
381194	openSUSE 16: cluster-md-kmp-nvidia64kb / dlm-kmp-nvidia64kb / etc (openSUSE-SU-2026:22307-1)	Nessus	SuSE Local Security Checks	Local	high
375086	Photon OS 5.0: Linux PHSA-2026-5.0-92-1044	Nessus	PhotonOS Local Security Checks	Local	critical
372307	Linux Distros Unpatched Vulnerability : CVE-2026-99060	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-99060

medium

Tenable Plugins

high

critical

medium