Riskcovery

CVE-2026-90350

wifi: mt76: reject out-of-range link ids in mt76_vif_link()

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: reject out-of-range link ids in mt76_vif_link()

mt76_vif_link() indexes mvif->link[] without validating link_id, but callers pass mvif->deflink_id / msta->deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.

Reachable via mt7996_set_tsf()/mt7996_offset_tsf() and mt7996_net_fill_forward_path(). Bounds check link_id and return NULL, matching mt7996_sta_link() and mt7996_sta_link_protected().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a9384b36a42afc2d715eb74c19a7ee558f09ef82 to before 13f6a9c786022d5213e84d494cc8717c378f5395Affected
  • a9384b36a42afc2d715eb74c19a7ee558f09ef82 to before c1442c345ca8da857fadea1d0797b97347ab6984Affected
  • a9384b36a42afc2d715eb74c19a7ee558f09ef82 to before 9ba744a28c26eaa5cae930688a22e01888395308Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.