CVE-2026-90350wifi: mt76: reject out-of-range link ids in mt76_vif_link()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76_vif_link() mt76_vif_link() indexes mvif->link[] without validating link_id, but callers pass mvif->deflink_id / msta->deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link. Reachable via mt7996_set_tsf()/mt7996_offset_tsf() and mt7996_net_fill_forward_path(). Bounds check link_id and return NULL, matching mt7996_sta_link() and mt7996_sta_link_protected().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a9384b36a42afc2d715eb74c19a7ee558f09ef82 before 13f6a9c786022d5213e84d494cc8717c378f5395; from a9384b36a42afc2d715eb74c19a7ee558f09ef82 before c1442c345ca8da857fadea1d0797b97347ab6984; from a9384b36a42afc2d715eb74c19a7ee558f09ef82 before 9ba744a28c26eaa5cae930688a22e01888395308 | CNA record |
References
- https://git.kernel.org/stable/c/13f6a9c786022d5213e84d494cc8717c378f5395
- https://git.kernel.org/stable/c/c1442c345ca8da857fadea1d0797b97347ab6984
- https://git.kernel.org/stable/c/9ba744a28c26eaa5cae930688a22e01888395308
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.