mt76: update to Git HEAD (2026-10-08)

162f8985525f wifi: mt76: mt7925: don't put the band auto marker in TGID
047558e81f6b wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
f3e7928585db wifi: mt76: fix memory leak in USB TX path
c50f17ec046e wifi: mt76: mt7603: initialize global station WCID
1297eb4e49fc wifi: mt76: mt7615: restore DBDC state after ext PHY failure
2009416d3f90 wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
7f30d9cb0d3e wifi: mt76: mt792x: pick the SAR table layout from the table itself
20f0979088b3 wifi: mt76: mt7915: publish wcid before MCU add commands
8f69e214f057 wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add()
7ff2f295a629 wifi: mt76: fix wcid teardown ordering in mt76_reset_device()
7fec0ac4e12c wifi: mt76: connac2: fill TXD spe_idx for connac2 fixed-rate frames
5073b08ce0c4 wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path
d7675366ff03 wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path
bbde131e8f2c wifi: mt76: move the channel survey when the channel changes
9e96501e32e5 wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
a2a78703435c wifi: mt76: mt7915: check default EEPROM firmware size before copying
56c8b4a4b407 wifi: mt76: mt7996: validate firmware event lengths before parsing
fee59a3f8bca wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure
fd3dc2614c73 wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump
40bd3ff75a69 wifi: mt76: mt7996: bound RRO session id before indexing addr_elem[]
27a48eed077f wifi: mt76: mt76x02: validate RX padding before use
17bfd775f483 wifi: mt76: mt7615: cancel reset work during unregister
c228f918e321 wifi: mt76: mt7925: keep MLD membership consistent during link add
c02187d15016 wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.
3318ff5daa93 wifi: mt76: mt7921: keep the join ROC until the station is authorized
fddc43d51481 wifi: mt76: mt7925: keep the join ROC until the station is authorized
790d1ae1e534 wifi: mt76: mt792x: defer the MCU shutdown past unregister on USB
4e819092f203 wifi: mt76: usb: fix source overread in mt76u_copy
be33bbd93f1a wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy
a0a409c3091d wifi: mt76: mt7915: fix thermal zone use-after-free
a374cac12909 wifi: mt76: mt7603: don't drop short frames looped back on PS entry
210948383adf wifi: mt76: mt7996: refresh the tx BA session timer on NPU devices
9559d859e64e wifi: mt76: avoid iter_keys_rcu() where not needed
d17b8d5eff29 wifi: mt76: mt7996: validate TLV length in mt7996_mcu_ie_countdown()
e51abae4a28e wifi: mt76: Fix spelling mistake "dowload" -> "download"
ecc63ee35093 wifi: mt76: mt7996: Fix spelling mistake "retriving" -> "retrieving"
b1bc93f95379 wifi: mt76: fix wcid->pktid corruption in mt76_wcid_cleanup()
c4809c50393c wifi: mt76: mt7925: Remove useless condition
08dd35bb504c wifi: mt76: mt7615: read MT7663 temperature from the correct offset
b94b75e4edcf wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()
1c9854c4365a wifi: mt76: mt7615: validate MCU response lengths
6163958192b9 wifi: mt76: connac: pass the command to mt76_connac_mcu_chip_config()
2fe9842d4a5f wifi: mt76: mt7921: enable thermal protection
c7dba52baf55 wifi: mt76: mt7996: guard station-only MLO TX handling
d855630e62e2 wifi: mt76: mt792x: fix negative errno truncation in offload capability
175a9b92ff39 wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()
0f7f2f6fd028 wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
ed623597107c wifi: mt76: feed the station RSSI average from the chain signals
aa0868c8a105 wifi: mt76: mt7921: clear WM2 from MT7902 RX all_complete_mask
7adc7a8e8398 wifi: mt76: mt7925: Fix MCU command timeouts during module unload
42bd01d693c6 wifi: mt76: mt7925: add AXI DMA calibration cache for MT7928
b260b1861071 wifi: mt76: abort a scan only for a link change on the scanning radio
5a9b590919a6 wifi: mt76: mt7996: enable the SKU power limit table
490519f8fb53 wifi: mt76: mt7996: set sniffer mode on a radio that is already running
53c7bed27b21 wifi: mt76: mt7996: update the address of an AP link that is added again
bc69664723f9 wifi: mt76: mt7996: size the MLD setup TLV by the links it describes
45f8f94c7cf1 wifi: mt76: mt7996: find the last MLD link among the links torn down
39bd92a3a5d7 wifi: mt76: mt7996: upload only the keys of the link being set up
a2464b215715 wifi: mt76: mt7996: do not walk the vif keys when a link is destroyed
b0ce6b0d6143 wifi: mt76: mt7996: report station statistics from the primary link
f2d50d200941 wifi: mt76: mt7996: clear all link wcid entries in sta_pre_rcu_remove
e46d47df718d wifi: mt76: mt7996: free the WTBL index if a link allocation fails
3aa923dc58e2 wifi: mt76: mt7996: pick the secondary link from links with driver state
965aa0ec734c wifi: mt76: mt7996: make a returning link primary if a station has none
50193c8fba22 wifi: mt76: mt7996: do not reuse the deflink of a removed station link
cf73928ba1a5 wifi: mt76: mt7996: keep a returning link when adding station links fails
f06234e078fa wifi: mt76: mt7996: add the station BMC entry as new once per BSSID
df395b4054af wifi: mt76: mt7996: keep 4-address and decap state per station
f6bb3fab6315 wifi: mt76: mt7996: do not add a station link in disconnected state
6db96c229855 wifi: mt76: mt7996: record the connection state of a station
bfa293034c38 wifi: mt76: mt7996: keep the block ack session parameters per station
0ea35bbe67f7 wifi: mt76: mt7996: set up the BSS of a late station link before its peer
8fce9b01ca98 wifi: mt76: mt7996: bring up station links added after association
42f455d1c817 wifi: mt76: mt7996: set up block ack sessions on station links added later
9ff341e9c17e wifi: mt76: mt7996: restore a station link that returns after a removal
8d6bbe90bedf wifi: mt76: mt7996: fix PLE free page and AC queue register offsets
8d0f3dbd4708 wifi: mt76: mt7996: fix the hw-queues debugfs queue requests
d39a5b53249c wifi: mt76: mt7996: disable the RX NAPIs before the DMA cleanup
dbdcc627e24c wifi: mt76: mt7996: keep the airtime weight of a station for HW ATF
d5ead84240fe wifi: mt76: mt7996: refuse scan and ROC until the hardware restart is done
960c1a94baf5 wifi: mt76: report an aborted scan or ROC to mac80211 during a reset
f6dbd94a444c wifi: mt76: mt7921: fix of_node reference leaks in regd update
b68c3cb175e6 wifi: mt76: mt792x: compute the assoc RSSI from the chain signals
0f37e419a340 wifi: mt76: remove the unused signal field from struct mt76_rx_status
bd5d316e5604 wifi: mt76: mt7996: take the offchannel link of a frame from its wcid
44625d0665e7 wifi: mt76: scan all radios of a request at the same time
65dce9c22385 wifi: mt76: mt7996: scan all bands with one request
d80e427a17db wifi: mt76: keep beacons from queueing the scan work during an abort
467ae2e3f190 wifi: mt76: bypass DPD on a scan channel while a monitor is active

Signed-off-by: Felix Fietkau <nbd@nbd.name>

package/kernel/mt76/Makefile

@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2026-09-01
-PKG_SOURCE_VERSION:=be5ce7910521492d4a2e4ce7ee3843680a46c047
-PKG_MIRROR_HASH:=d1d0f7588c5b9ceafcac341ce19dd206ed9ec106847e672ab77e48bacb57f81a
+PKG_SOURCE_DATE:=2026-10-08
+PKG_SOURCE_VERSION:=467ae2e3f190baf737e15e318906da0dc7d0ab91
+PKG_MIRROR_HASH:=2456aeba71bcda19445d539c11f165ab79f5c253345e0c6f6b3b506de01c0fdb
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0