CVE-2025-68765: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68765 is a memory leak vulnerability in the Linux kernel's mt76 wireless driver, specifically within the mt7615_mcu_wtbl_sta_add() function of the MT7615 chipset driver. When a socket buffer (sskb) is allocated and a subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error without freeing sskb, resulting in a kernel memory leak. The vulnerability was published on January 5, 2026, and affects Linux kernel versions shipping the mt76/mt7615 driver. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Red Hat CVE, Feedly).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the mt76 kernel driver's MT7615 MCU station table management code. In mt7615_mcu_wtbl_sta_add(), an skb (socket buffer) named sskb is allocated early in the function. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() returns an error, the function exits the error path without calling dev_kfree_skb() on sskb, leaking the allocated kernel memory. The fix adds a dev_kfree_skb(sskb) call in the error handling path to ensure proper release. Exploitation requires local access to a system running the affected MT7615 wireless driver (Red Hat CVE, kernel.org patches).

The primary impact is an availability risk: repeated triggering of the error condition in mt7615_mcu_wtbl_sta_add() causes unreleased kernel memory to accumulate over time, potentially leading to system performance degradation, instability, or a denial-of-service condition if memory is sufficiently exhausted. There is no confidentiality or integrity impact associated with this vulnerability. The scope is limited to the local system running the affected MT7615 wireless driver (Feedly).

Apply the upstream Linux kernel patches that add dev_kfree_skb() to the error handling path in mt7615_mcu_wtbl_sta_add(). Multiple stable kernel branches have been patched, with fixes available at several kernel.org stable commits (e.g., 278bfed4, 4d42aba0, 53d15486, fb905e69, 1c3c234a, 594ff8bb, d6c91fc7). Downstream distributions including Debian (linux 6.1.162-1, DLA-4476-1), Ubuntu (USN-8179-1/2/3/4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Microsoft Azure Linux 3 have released updated kernel packages. Users should update to the latest patched kernel version provided by their distribution (Red Hat CVE, Debian LTS, Ubuntu USN-8179-1).