CVE-2026-90353

wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

State: Published
Severity: 7.0 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

After mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw. Unregister the ext PHY (thermal + phy + hw) first and skip the redundant free.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before aa55bec92ba7747dd08feff409f8074c5e052e71Affected 7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before ad706fcf6255494613b94418e7243d98065dbeafAffected 7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before 34058ad122f7524e33df8e38caba4b1d803b025aAffected 7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5Affected 7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before 648f5f03ff50d4bd719106ace0cdf1d8be02cbddAffected 7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before 15b960014f24dce5388d4a2e7274e6490cb3c421Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before aa55bec92ba7747dd08feff409f8074c5e052e71Affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before ad706fcf6255494613b94418e7243d98065dbeafAffected
7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before 34058ad122f7524e33df8e38caba4b1d803b025aAffected
7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5Affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before 648f5f03ff50d4bd719106ace0cdf1d8be02cbddAffected
7b8e1ae886e45aed9274048f2836a70b75ecfa40 to before 15b960014f24dce5388d4a2e7274e6490cb3c421Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.