CVE-2026-90374

wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 21, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

band_idx comes from a 2-bit descriptor field (0-3) and was used directly to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the result. A corrupt or reserved descriptor value could index out of bounds or hit a NULL phy on parts with fewer bands. Reject invalid band indices, mirroring mt7996_rx_get_wcid().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	98686cd21624c75a043e96812beadddf4f6f48e5 to before 493a029c205a994644327d554f0cfeb9651aba7cAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before 535091c587268cc783608642838a655d828eefddAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before 0f53ece876e1f3bbb3e18f48afc4af1ee967b16cAffected 98686cd21624c75a043e96812beadddf4f6f48e5 to before b1c5cf8903bec5476a2233b4e45287b9a2213e02Affected 98686cd21624c75a043e96812beadddf4f6f48e5 to before 2243778a5fae8329ab5f18e7adcd7e03b911a1b7Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

98686cd21624c75a043e96812beadddf4f6f48e5 to before 493a029c205a994644327d554f0cfeb9651aba7cAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before 535091c587268cc783608642838a655d828eefddAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before 0f53ece876e1f3bbb3e18f48afc4af1ee967b16cAffected
98686cd21624c75a043e96812beadddf4f6f48e5 to before b1c5cf8903bec5476a2233b4e45287b9a2213e02Affected
98686cd21624c75a043e96812beadddf4f6f48e5 to before 2243778a5fae8329ab5f18e7adcd7e03b911a1b7Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.