CVE-2025-68765

Vulnerability

In the Linux kernel's mt76 wireless driver, the function mt7615_mcu_wtbl_sta_add() allocates a socket buffer (skb) via dev_alloc_skb(). If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error without freeing the allocated skb, causing a memory leak [1].

Exploitation

An attacker with local access or the ability to trigger the vulnerable code path (e.g., by adding a station to the MT7615 wireless device) can repeatedly cause the allocation failure, leading to gradual memory exhaustion. The leak is triggered when mt76_connac_mcu_alloc_wtbl_req() returns an error, which may occur under resource pressure or due to invalid parameters.

Impact

Repeated exploitation can exhaust kernel memory, potentially leading to denial of service (system hang or crash). No privilege escalation or data is provided.

Mitigation

The fix, committed to the Linux kernel stable tree, adds a dev_kfree_skb() call in the error path to release the skb before returning [1]. Users should apply the patch or update to a kernel version containing the fix.