CVE-2026-90382

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a corrupted frame can report a length larger than the received buffer. The bounds check correctly discards such frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage frame taints the kernel, and panics it on the first such frame when panic_on_warn is set.

Drop the WARN and discard the frame silently, matching what commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx status and rx path") did for the neighboring rx and tx status paths.

Observed immediately on rx with an MT7612U in fcsfail monitor mode on a busy channel.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7bc04215a66b60e198aecaee8418f6d79fa19faa to before 61b1f6d92249bc34580ff19de7c69c805f82adcaAffected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfeAffected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before d55e7aede542c4c76ead82d37d0c112f21eb2ac2Affected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before b6e7958602bd1acdb8ae92703b6689a28bcc9bc0Affected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before 2d31e332c13b1db7745a7bd9cf74bc105524bcacAffected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before 17d6b89e09eac2d90272fceeba3644e92212e02fAffected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before 6def491fe9c4e83aa8cba62d74e9d4ab751ee967Affected 7bc04215a66b60e198aecaee8418f6d79fa19faa to before 81497634d9f872fd3e8b03aada55574afff6f174Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

7bc04215a66b60e198aecaee8418f6d79fa19faa to before 61b1f6d92249bc34580ff19de7c69c805f82adcaAffected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfeAffected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before d55e7aede542c4c76ead82d37d0c112f21eb2ac2Affected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before b6e7958602bd1acdb8ae92703b6689a28bcc9bc0Affected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before 2d31e332c13b1db7745a7bd9cf74bc105524bcacAffected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before 17d6b89e09eac2d90272fceeba3644e92212e02fAffected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before 6def491fe9c4e83aa8cba62d74e9d4ab751ee967Affected
7bc04215a66b60e198aecaee8418f6d79fa19faa to before 81497634d9f872fd3e8b03aada55574afff6f174Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.