On July 19, 2026, the Linux kernel project published CVE-2026-63832, a vulnerability in the mt76 wireless driver that can corrupt kernel memory and crash systems using MediaTek MT7925 Wi-Fi adapters. The fix is now available in Linux kernels 6.18.38 and 7.1.3. For the vast majority of Windows users, this CVE is a non-event—your PC’s Wi-Fi stack is completely separate. But if you dual-boot Linux, run a virtual machine with a passed-through MediaTek adapter, or tinker with custom WSL2 kernels, you need to act.

The Flaw: List Corruption During Wi-Fi Reconnects

The bug lurks in a core function called mt76_sta_add, which handles new wireless client connections. When an MT7925 adapter associates with an access point, the driver publishes a wireless client ID (WCID) to make it visible to other kernel subsystems. The problem? That publication happened before the shared mt76 code finished initializing an internal polling list (wcid->poll_list). If the list was reinitialized afterward, it could corrupt a kernel-internal linked list (dev->sta_poll_list), leading to memory errors.

This wasn’t discovered in a sophisticated attack. According to the official CVE entry from kernel.org, a tester running Linux 7.1-rc4 triggered it simply by disconnecting from one access point and authenticating to another. The kernel spat out a list_add corruption warning, showing that a list node’s prev->next pointer had been twisted to point back to itself instead of the next entry. In practical terms, this can cause network instability, automatic driver resets, or full-on kernel panics—especially on machines that roam frequently between Wi-Fi networks.

Despite the immediate trigger being a reconnect, the underlying issue is a classic lifetime bug: an object was made visible too early. The fix, now merged into the stable kernel branches, adds a check to skip reinitialization if the WCID has already been published. It’s a small, surgical patch.

As of July 20, the National Vulnerability Database had not yet assigned a CVSS score, and no CWE classification was listed. However, security vendor Tenable has rated this vulnerability as High with a CVSS 3.0 score of 7.8. No known exploit exists in the wild, but kernel memory corruption is never benign—it could potentially be leveraged for privilege escalation or denial of service.

Windows Is Not Vulnerable—Here’s Exactly Why

Windows handles Wi-Fi differently. A MediaTek wireless adapter in a Windows machine uses a vendor-supplied NDIS driver and Microsoft’s networking stack. The vulnerable code lives in drivers/net/wireless/mediatek/mt76/mac80211.c, a file compiled only into the Linux kernel. Updating your Windows MediaTek WLAN driver won’t touch this Linux-specific flaw. There is no Windows Update, no Microsoft Security Response Center advisory, and no patch to install on the Windows side because the vulnerability simply doesn’t exist there.

That said, the same physical hardware can still be dangerous if you boot into a Linux environment. Any operating system that directly controls the MT7925 adapter using the mt76 driver is at risk. That’s where dual-boot setups, external Linux boot media, and certain virtualization configurations come into play.

Scenarios Where a Windows User Might Be Affected

Home users with single-boot Windows PCs: You’re safe. Even if you run Windows Subsystem for Linux 2 (WSL2) in its default configuration, the Linux guest uses a virtualized network interface that never touches the physical Wi-Fi adapter—so the vulnerable driver isn’t loaded. Danger only arises if you physically boot into a Linux distribution installed alongside Windows (dual-boot) on hardware that includes an MT7925 wireless chip. Not sure which MediaTek adapter you have? Open Device Manager on Windows, expand “Network adapters,” and look for a MediaTek entry. If the name includes MT7925, take note.

Power users and developers: If you run virtual machines with PCIe or USB pass-through and hand the MediaTek adapter to a Linux guest, that guest needs the patched kernel. Similarly, if you’ve built a custom WSL2 kernel and arranged for it to directly access the physical adapter (a rare but possible setup), you must apply the fix there. Standard WSL2 networking, which relies on a virtual switch, is unaffected.

IT administrators: Scan your fleet for devices that boot Linux—laptops used by developers, test machines, or network appliances built on Linux with MediaTek chips. Don’t assume that a Windows sticker on the chassis means the machine never runs Linux. Also check Linux-based routers or access points that use MT7925 chipsets; those require firmware-level kernel updates from the vendor. For corporate environments, focus on dual-boot workstations and any Linux VMs with hardware pass-through.

The Timeline: From Bug Discovery to Patch

The defect was spotted during kernel 7.1-rc4 testing, likely in mid-2026. The stack trace in the original report showed the corruption caught in mt76_wcid_add_poll, called from transmit status handling, and traced through mt7925_mac_add_txs and the DMA receive poller. The vulnerability likely dates back to when MT7925 support was first integrated into the mt76 driver—the faulty initialization logic persisted through multiple kernel releases.

Kernel maintainers responded quickly. The patch was merged into the upstream development tree and backported to stable branches: 6.18.38 for the 6.18 series, 7.1.3 for the 7.1 series, and 7.2-rc1 as the original commit for the fix. The CVE went public on July 19 and appeared in the National Vulnerability Database the same day, with a revised affected-versions table on July 20. For distributions like Red Hat, Ubuntu, SUSE, and Debian, backported fixes will roll out through their regular security channels—so check your distro’s advisories rather than relying solely on upstream version numbers.

Your Action Plan: Steps to Take Now

  1. Identify if you use MT7925 Wi-Fi on Linux. Run lspci | grep -i mt7925 on any Linux system. If it returns an entry, you’re affected.
  2. Update the Linux kernel. For mainline kernels, upgrade to at least 6.18.38, 7.1.3, or 7.2-rc1. Use uname -r to check your current version. For distribution kernels, a standard apt upgrade or dnf update followed by a reboot is sufficient—backported fixes will have different package numbers, so consult your vendor’s security notice.
  3. Verify the fix. After rebooting, confirm the kernel version and check that the mt76 module is the updated one. For custom-built kernels, ensure commit 20b126920a25 (or its equivalent for your stable branch) is included. If you maintain an out-of-tree driver backport, recompile with the patched source.
  4. Reboot, don’t just reload. The change is in kernel code that cannot be applied live. Unloading and reloading the Wi-Fi module is not a reliable substitute on production systems.
  5. If immediate patching isn’t possible, reduce the risk by minimizing Wi-Fi roaming. Avoid disconnecting and reconnecting frequently; if your workflow allows, stick to one access point. But this is a temporary workaround, not a long-term strategy. For critical systems, consider disabling the wireless interface until you can update.
  6. For dual-booters, update the Linux side. If you rarely boot into Linux, consider whether you even need to keep that partition active—otherwise, schedule the update. Remember that booting an outdated Linux kernel with the MT7925 adapter active risks a crash.
  7. For VMs with passthrough, update the guest Linux kernel. Patching the host does not protect the guest if the guest is driving the hardware directly.
  8. Windows-only machines: No action required. There is no Microsoft security advisory for this CVE because it’s not a Windows vulnerability. Don’t be alarmed by security scanners that might flag the CVE based on hardware inventory; confirm the operating system responsible for the adapter before reacting.

Outlook: What to Watch For

At this stage, CVE-2026-63832 is a stability and potential security fix with no known real-world exploits. However, if security researchers later demonstrate reliable exploitation—perhaps leveraging the corruption for local privilege escalation—the CVE’s profile could rise. Linux distributions will continue to push backported patches, and appliance vendors will issue firmware updates. For the Windows community, the story is a reminder that hardware shared between multiple operating systems requires diligence on all fronts. Keep your Linux installations as current as your Windows ones, and this bug stays on the list of things you’ve already fixed.