CVE-2026-90353

What it actually does

A use-after-free occurs in the mt7915 WiFi driver when an error path after mt7915_register_ext_phy succeeds frees the ext PHY hw via ieee80211_free_hw while it remains registered with mac80211 because mt76_unregister_device only handles the main hw.

Why it matters to the business

Affected Linux systems using mt7915 hardware risk kernel crashes or local privilege escalation that can disrupt wireless connectivity and expose the device to compromise.

How an attack unfolds

A local attacker triggers driver initialization that succeeds for the external PHY but then fails in mt7915_init_debugfs or mt7915_coredump_register, causing the incorrect free_phy2 path to dereference the still-registered structure.

How to fix it

Apply the upstream kernel patch that unregisters the ext PHY (thermal + phy + hw) before any redundant free on the error path; update to a Linux kernel release containing this fix.

How to confirm the fix worked

Inspect the mt7915_register_ext_phy error handling in the kernel source for the corrected unregister sequence and confirm successful ext PHY registration under simulated init failures.

Typical attack path

1. Obtain local access to the target system
2. Load the mt76/mt7915 module or trigger ext PHY registration
3. Force a failure in main PHY debugfs or coredump registration
4. Trigger the flawed error unwind that performs the use-after-free

How to detect it

Review kernel logs and dmesg output for use-after-free warnings or panics involving ieee80211_free_hw and mt7915 during module initialization or ext PHY registration failures.

What your security team should do

• Patch affected kernels at the earliest opportunity
• Restrict local access on systems exposing the mt7915 driver
• Monitor kernel logs for oopses during WiFi module load