CVE-2025-68360: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68360 is a kernel memory access vulnerability in the Linux kernel's MT76 WiFi driver (mt76: wed) affecting MediaTek MT7996 hardware. The flaw causes the driver to incorrectly use the primary wed device reference instead of wed_hif2 during WED (Wireless Ethernet Dispatch) callbacks, triggering a kernel read from an unreadable memory address when the hardware operates on the 6GHz link. It was disclosed on December 24, 2025, and affects Linux kernel versions running the MT7996 WiFi driver with wed_hif2 support. The CVSS v3.1 base score is 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an improper pointer/reference handling bug (CWE-822: Untrusted Pointer Dereference) in the MT76 WED driver callbacks. The MT7996 driver supports two WED devices — wed (primary) and wed_hif2 (secondary, used for 6GHz traffic offloading) — but the callback logic always dereferences the primary wed device reference regardless of which device is active. When wed_hif2 is in use (e.g., during 6GHz link operation), the incorrect reference results in a kernel read from virtual address 0x000000000000080a, triggering a level 1 translation fault and kernel panic (Oops: 0000000096000005). The crash trace shows the fault occurring in mt76_wed_offload_disable called via mtk_wed_flow_remove during netfilter flow table offload operations (Red Hat Bugzilla). Exploitation requires local access with low privileges and high attack complexity, as the vulnerable code path is triggered by specific hardware and network conditions.

Successful triggering of this vulnerability causes a kernel panic (system crash), directly impacting availability. Beyond denial of service, the CVSS assessment rates confidentiality and integrity impacts as High, indicating potential for unauthorized kernel memory reads or memory corruption if the invalid dereference is exploited in a controlled manner rather than simply crashing the system. The vulnerability is scoped to systems running the Linux kernel with MediaTek MT7996 WiFi hardware (e.g., Banana Pi BPI-R4) using the 6GHz band with WED traffic offloading enabled (Red Hat CVE, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing Unable to handle kernel read from unreadable memory at virtual address 000000000000080a and Internal error: Oops: 0000000096000005.
• Logs: Call trace entries referencing mt76_wed_offload_disable, mtk_wed_flow_remove, mtk_flow_offload_cmd, and mtk_wed_setup_tc_block_cb in kernel oops output.
• Logs: Workqueue entries for nf_ft_offload_del / nf_flow_rule_route_ipv6 associated with the crash.
• System Behavior: Unexpected system reboots or kernel panics on hosts running MT7996 WiFi hardware with 6GHz band active and WED offloading enabled (Red Hat Bugzilla).

The fix has been committed to the Linux kernel stable tree, correcting the WED device reference detection logic in the MT76 driver callbacks (patches available at git.kernel.org stable commits 385aab8fccd7, ab94ecb997fd, and d582d0e988d6). Users should update to a patched Linux kernel version that includes this fix. As a workaround, disabling 6GHz band operation or WED hardware offloading on affected MT7996 devices can prevent the vulnerable code path from being triggered. Restricting local user access and applying security modules (SELinux/AppArmor) can reduce exposure (Red Hat CVE, Red Hat Bugzilla).