CVE-2026-90356

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset

mt7996_mac_reset_vif_iter() queues non-default vif links for kfree_rcu

while dev->wcid[] still holds pointers to the wcid embedded in each

freed link; mt76_reset_device() then dereferences those entries and

runs mt76_wcid_cleanup() on them. If a grace period elapses in between,

the cleanup operates on freed memory.

Run mt76_reset_device() first, so the wcid entries are cleaned up and

cleared while the links are still valid.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References