CVE-2026-90351

What it actually does

Improper error handling in the mt76 mt7996 WiFi driver allows secondary hif2 WED attachment after primary WED failure, resulting in inconsistent half-attached device state and later kernel crash; the secondary path also re-enables hwrro_mode that the primary failure had disabled.

Why it matters to the business

Systems using affected WiFi hardware may experience sudden crashes or instability during device initialization, leading to downtime and loss of wireless connectivity until reboot.

How an attack unfolds

An attacker with local access or a hardware fault induces failure of the primary PCIe WED attach during probe; the driver still proceeds with the hif2 secondary attachment, leaving the device in a corrupted state that crashes the kernel on subsequent operations.

How to fix it

Apply the upstream kernel patch that skips hif2 WED setup when the primary WED device is not active; rebuild and deploy the fixed kernel to affected systems.

How to confirm the fix worked

Inspect dmesg or kernel logs after loading the mt76 driver for successful primary WED attach messages without subsequent hif2 attachment attempts; confirm the fix by reviewing the mt7996 probe code path.

Typical attack path

1. Trigger or simulate failure of primary WED attach for the mt7996 device
2. Allow the probe routine to continue and attach wed_hif2 for the secondary function
3. Re-enable hwrro_mode via the secondary path despite primary failure
4. Trigger later device activity that exposes the inconsistent state and crashes the kernel

How to detect it

Review kernel logs and dmesg output for mt76 driver messages mentioning WED attach failures followed by hif2 attempts or hwrro_mode changes; look for associated oops or panic traces on systems with mt7996 hardware.

What your security team should do

• Prioritize kernel updates for systems with mt7996 hardware within normal patch cycles
• Monitor kernel crash reports and WiFi driver initialization logs for related failures
• Test the updated driver in a lab environment before broad deployment