CVE-2026-90382wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a corrupted frame can report a length larger than the received buffer. The bounds check correctly discards such frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage frame taints the kernel, and panics it on the first such frame when panic_on_warn is set. Drop the WARN and discard the frame silently, matching what commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx status and rx path") did for the neighboring rx and tx status paths. Observed immediately on rx with an MT7612U in fcsfail monitor mode on a busy channel.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7bc04215a66b60e198aecaee8418f6d79fa19faa before 61b1f6d92249bc34580ff19de7c69c805f82adca; from 7bc04215a66b60e198aecaee8418f6d79fa19faa before c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe; from 7bc04215a66b60e198aecaee8418f6d79fa19faa before d55e7aede542c4c76ead82d37d0c112f21eb2ac2; from 7bc04215a66b60e198aecaee8418f6d79fa19faa before b6e7958602bd1acdb8ae92703b6689a28bcc9bc0; 7bc04215a66b60e198aecaee8418f6d79fa19faa builds before 2d31e332c13b1db7745a7bd9cf74bc105524bcac; from 7bc04215a66b60e198aecaee8418f6d79fa19faa before 17d6b89e09eac2d90272fceeba3644e92212e02f; 7bc04215a66b60e198aecaee8418f6d79fa19faa builds before 6def491fe9c4e83aa8cba62d74e9d4ab751ee967; from 7bc04215a66b60e198aecaee8418f6d79fa19faa before 81497634d9f872fd3e8b03aada55574afff6f174 | CNA record |
References
- https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca
- https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe
- https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2
- https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0
- https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac
- https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f
- https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967
- https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.