Riskcovery

CVE-2026-90380

wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

State
Published
Severity
8.8 High
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

A use-after-free issue occurs in mt76_rx_poll_complete due to a race condition. The STA has already been removed, but the rx_status still had a pointer to the wcid in the STA.

Set the links' wcid pointers to be NULL for a MLD in mt7925_sta_pre_rcu_remove()

BUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470 Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0xc8 print_report+0x1b8/0x710 kasan_report+0xe0/0x144 do_bad_area+0x120/0x260 do_tag_check_fault+0x20/0x34 do_mem_abort+0x54/0xa8 el1_abort+0x3c/0x5c el1h_64_sync_handler+0x40/0xcc el1h_64_sync+0x7c/0x80 mt76_rx_poll_complete+0x280/0x470 mt76_dma_rx_poll+0x114/0x51c mt792x_poll_rx+0x60/0xf8 napi_threaded_poll_loop+0xe0/0x450 napi_threaded_poll+0x80/0x9c kthread+0x11c/0x158 ret_from_fork+0x10/0x20

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to before aaf414bf81ab4b680580871784b0b929818188ebAffected
  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to before 2aa3d3b9fac9163e9226e35556607ae3f75be21eAffected
  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to before b250943f3f8351385a17972bda001664a5c51008Affected
  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to before 217f9e7bb02558759be9d9ecfe532e9708741c50Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.