CVE-2025-68765 mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
A memory leak in the mt7615 Wi-Fi driver allows attackers to cause denial of service by exhausting kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68765?
CVE-2025-68765 is a memory corruption vulnerability in Linux, published on 5 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error without freeing sskb, leading to a memory leak.
Fix this by calling dev_kfree_skb() on sskb in the error handling path to ensure it is properly released.
Which versions are affected by CVE-2025-68765?
How do I fix CVE-2025-68765?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-68765 being exploited?
There is no known exploitation of CVE-2025-68765 in the wild and no public exploit code.
Sources
Also known as AZL-73400, BELL-CVE-2025-68765, DEBIAN-CVE-2025-68765, GHSA-rrcc-67m8-5vg7, ROOT-OS-DEBIAN-11-CVE-2025-68765, ROOT-OS-DEBIAN-12-CVE-2025-68765 and 4 more.