CVE-2026-90366

wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic(). Reserve room for both countdown TLVs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	98686cd21624c75a043e96812beadddf4f6f48e5 to before 1d348f96623ec20d700af7d4dfc00a74da6238acAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before bc1d694a1ffe0062c3adf0db1d64ad54454398ecAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before 45d8896e4cffffb2c6554ccbec6efe7a0d53166fAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before 1a51aff0e048dc5b8252d65808b79939c942d6ecAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before 50c66bab321140c49aa2ed779a3ec9d2f085b458Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

98686cd21624c75a043e96812beadddf4f6f48e5 to before 1d348f96623ec20d700af7d4dfc00a74da6238acAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before bc1d694a1ffe0062c3adf0db1d64ad54454398ecAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before 45d8896e4cffffb2c6554ccbec6efe7a0d53166fAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before 1a51aff0e048dc5b8252d65808b79939c942d6ecAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before 50c66bab321140c49aa2ed779a3ec9d2f085b458Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.