CVE-2026-90373 (GCVE-0-2026-90373)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-30 12:35
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915_remove_interface() cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the allocators, which all run under dev->mt76.mutex; on DBDC the two wiphys share one mt76_dev, so this raced add_interface/sta_add on the other band and could leak or double-hand-out a wcid. Clearing the bit before the RCU pointer also let a concurrent allocation reuse the index and publish its wcid, which the subsequent NULL assignment then wiped. Move the clear into the existing mutex section, after the RCU pointer is cleared.
References
Impacted products
Vendor Product Version
Linux Linux Version: f3049b88b2b32326df97461813ae73e8bbc296fc
Version: f3049b88b2b32326df97461813ae73e8bbc296fc
Version: f3049b88b2b32326df97461813ae73e8bbc296fc
Version: f3049b88b2b32326df97461813ae73e8bbc296fc
Version: b7c8e22dfddacc1b08dbf44f5be2c66305d757bc
Version: a582b1d54313dcdc96e7d8e1f49495dd71ddaf3e
Version: 6.1.191   ≤
Version: 6.6.160   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5dce25f1d609ba991a9c22c27be586c92f03ed77",
              "status": "affected",
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "versionType": "git"
            },
            {
              "lessThan": "b4a41a47a67c788e6b0625fa517ec8872e99bb6c",
              "status": "affected",
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "versionType": "git"
            },
            {
              "lessThan": "a97b2b942d2f8f12fbd6a7caafc735d1ad115e6b",
              "status": "affected",
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "versionType": "git"
            },
            {
              "lessThan": "6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba",
              "status": "affected",
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b7c8e22dfddacc1b08dbf44f5be2c66305d757bc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a582b1d54313dcdc96e7d8e1f49495dd71ddaf3e",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.160",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.191",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.160",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear\n\nmt7915_remove_interface() cleared the wcid mask bit with no lock held and\nbefore clearing the RCU wcid pointer. The mask is a non-atomic RMW shared\nwith the allocators, which all run under dev-\u003emt76.mutex; on DBDC the two\nwiphys share one mt76_dev, so this raced add_interface/sta_add on the\nother band and could leak or double-hand-out a wcid. Clearing the bit\nbefore the RCU pointer also let a concurrent allocation reuse the index\nand publish its wcid, which the subsequent NULL assignment then wiped.\nMove the clear into the existing mutex section, after the RCU pointer is\ncleared."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:35:23.858Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5dce25f1d609ba991a9c22c27be586c92f03ed77"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4a41a47a67c788e6b0625fa517ec8872e99bb6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a97b2b942d2f8f12fbd6a7caafc735d1ad115e6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba"
        }
      ],
      "title": "wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90373",
    "datePublished": "2026-09-17T16:09:13.368Z",
    "dateReserved": "2026-09-11T19:38:34.808Z",
    "dateUpdated": "2026-10-30T12:35:23.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.