CVE-2026-90352

What it actually does

Reference leak of hif2 structure obtained during mt7915_pci_init_hif2 when pci_alloc_irq_vectors or primary devm_request_irq fails, because the pointer is not yet stored in dev->hif2 and no explicit release via mt7915_put_hif2 occurs on those paths.

Why it matters to the business

Repeated device probe failures on affected mt7915 hardware can cause gradual accumulation of unreleased references, leading to memory pressure and potential instability or denial of service in long-running systems.

How an attack unfolds

An attacker with local access or the ability to repeatedly trigger PCI device probe failures (for example through hardware faults or driver reloads) can induce the leak; no remote unauthenticated exploitation path exists and no threat actors are known to target this issue.

How to fix it

Update the Linux kernel to a version containing the fix that adds explicit mt7915_put_hif2 calls on the IRQ failure paths in mt7915 probe.

How to confirm the fix worked

Inspect the mt7915 probe function in the mt76 driver source to confirm mt7915_put_hif2 is invoked on every error return after mt7915_pci_init_hif2 succeeds.

Typical attack path

1. Cause mt7915 PCI probe to reach pci_alloc_irq_vectors or devm_request_irq
2. Trigger failure in one of those calls before dev->hif2 is assigned
3. Repeat the failing probe sequence to accumulate leaked references

How to detect it

Review kernel ring buffer and dmesg output for repeated mt7915 PCI probe or IRQ allocation failure messages; correlate with memory usage growth on systems using mt7915 hardware.

What your security team should do

• Apply available kernel updates for the mt76/mt7915 driver at the next maintenance window
• Monitor kernel logs for repeated mt7915 probe or IRQ allocation failures
• Test wireless hardware bring-up under simulated error conditions after patching