Not yet scoredPublished Sep 17, 2026

CVE-2026-90355wifi: mt76: mt7996: clear stale link state on full reset

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996_vif_link_add() short-circuits when the link_id is still marked in mvif->valid_links, a state introduced for postponing link teardown to interface removal. The reset path frees the link structures without clearing those bits, so the replayed setup never re-creates dev_info/bss_info/STA records in the restarted firmware and never re-registers the link wcid, leaving the device inoperative. The reset path also leaks every allocated MLD index: per-link indices and the per-vif group/remap indices are re-allocated from scratch during reconfig, but the old bits stay set in the masks, so repeated full resets exhaust the index space. Clear valid_links in the reset vif iterator and reset the MLD index masks alongside the existing omac_mask clearing.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ace5d3b6b49e8391beb4d7244348ba7da5298878 before e512823aabbdc91444b9d886638f059ef58e86b1; from ace5d3b6b49e8391beb4d7244348ba7da5298878 before fc3762724a36867c1749233c43368c2637ecf029; from ace5d3b6b49e8391beb4d7244348ba7da5298878 before 75d2a4e2129b58bb0ddb842387299038495aad2a	CNA record

References

https://git.kernel.org/stable/c/e512823aabbdc91444b9d886638f059ef58e86b1
https://git.kernel.org/stable/c/fc3762724a36867c1749233c43368c2637ecf029
https://git.kernel.org/stable/c/75d2a4e2129b58bb0ddb842387299038495aad2a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.