Cloudanix VulnDB

CVE-2026-90349

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in a common Linux Wi-Fi driver can let an attacker crash the system or possibly run code by sending certain wireless frames before the hardware is fully set up.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read/write via unchecked use of IEEE80211_LINK_UNSPECIFIED (0xf) as an array index into 15-entry link arrays (vif->link_conf[], mvif->mt76.link[], sta->link[]) inside mt7996_tx() before any link has been configured.

Why it matters to the business

Kernel memory corruption or crash on systems using the affected MediaTek mt7996 Wi-Fi hardware; the issue has been public for 37 days with negligible exploit probability and no observed in-the-wild use.

How an attack unfolds

An attacker with local or remote access that can trigger frame transmission through mt7996_tx while mac80211 still reports an unspecified link ID causes the driver to index past the end of the link arrays, potentially allowing memory corruption.

How to fix it

Apply the upstream fix that clamps the primary link ID to the default link value before any array access; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the clamping logic in mt7996_tx() and that IEEE80211_LINK_UNSPECIFIED is never used as an index; verify the running kernel contains the commit that resolves the out-of-bounds access.

Typical attack path

  1. Obtain code execution or network adjacency sufficient to cause 802.11 frame transmission on an mt7996 interface
  2. Force mac80211 to call mt7996_tx with link ID set to IEEE80211_LINK_UNSPECIFIED before any link is added to the station or vif
  3. Trigger the unchecked array indexing of vif->link_conf, mvif->mt76.link and sta->link
  4. Leverage resulting out-of-bounds access for memory corruption or denial of service

How to detect it

Review kernel logs for mt7996 or mac80211 oops/panic traces referencing link array indexing; inspect crash dumps for out-of-bounds accesses originating in mt7996_tx.

What your security team should do

  • Prioritize kernel updates on any host exposing mt7996 hardware once a fixed release is available
  • Monitor upstream wireless and stable kernel trees for the patch landing
  • Temporarily restrict use of the mt7996 driver on high-value systems until patched kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx() When mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[], mvif->mt76.link[] and sta->link[], all of which hold IEEE80211_MLD_MAX_NUM_LINKS (15) entries. Clamp the primary link id to the default link before using it, and use the clamped value for the link_sta fallback as well.

Affected packages

Ecosystem Package Introduced Fixed