Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: account non-AQL frames per peer rather than per link
The driver increments wcid->non_aql_packets when a frame goes to the
hardware queue. The completion path decrements the counter again.
For an MLO peer, the hardware reports the completion on the link that it
used for the transmission. This link can differ from the link that the
driver queued the frame on. In that case, the increment and the
decrement go to different link wcids, and the count drifts upwards until
it blocks the station.
Keep the count on the wcid of the primary link, like the other peer-wide
state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.11 | 6.18.57 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.2.11-1 | — |
| Debian 13 | linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | linux | 7.3.0-10.10 | — |
| Ubuntu 26.10 | linux-aws +4 | 7.3.0-1004.4 | — |
| Ubuntu 26.10 | linux-azure-fde | 7.3.0-1004.5 | — |
| Ubuntu 26.10 | linux-riscv +1 | 7.3.0-10.10.1 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-43.43 | USN-9018-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1017.18 | USN-9018-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1020.21 | USN-9019-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1019.19 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-gcp | 7.0.0-1017.19 | USN-9018-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1010.11 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1018.18 | USN-9018-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1016.18 | USN-9018-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-realtime | 7.0.0-43.43.1 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1017.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1019.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 | 7.0.0-1017.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-43.43~24.04.1 | USN-9018-2 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1016.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-riscv +29 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-43.43.1~24.04.2 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
Advisories 6
- USN-9018-2 linux-hwe-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-4152 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9019-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9018-1 linux, linux-aws, linux-gcp, linux-ibm, linux-oem-7.0, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 11, 2026