CVE-2026-68309: wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

mt76_connac_get_he_phy_cap routine can theoretically return NULL so
check cap pointer before dereferencing it.

The Linux kernel CVE team has assigned CVE-2026-68309 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.12 with commit d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8 and fixed in 6.6.148 with commit b09508dd7bc4a8948ea00603041a918c09788502
	Issue introduced in 5.12 with commit d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8 and fixed in 6.12.101 with commit 2afc2d5098866518a5c446a2e647b1b3f43daaf4
	Issue introduced in 5.12 with commit d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8 and fixed in 6.18.42 with commit c058786b09cfab080125bc3ee7928a181dcbd37a
	Issue introduced in 5.12 with commit d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8 and fixed in 7.1.6 with commit 8709c66e665a2a09192853d4f3d0fb4bd0f76403
	Issue introduced in 5.12 with commit d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8 and fixed in 7.2-rc5 with commit 2c1fb2335f5e3afb34f91bc07ecb63517c328090

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68309
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b09508dd7bc4a8948ea00603041a918c09788502
	https://git.kernel.org/stable/c/2afc2d5098866518a5c446a2e647b1b3f43daaf4
	https://git.kernel.org/stable/c/c058786b09cfab080125bc3ee7928a181dcbd37a
	https://git.kernel.org/stable/c/8709c66e665a2a09192853d4f3d0fb4bd0f76403
	https://git.kernel.org/stable/c/2c1fb2335f5e3afb34f91bc07ecb63517c328090