Cloudanix VulnDB

CVE-2026-90354

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding error in a wireless driver could cause certain network cards to leak resources and become unstable when the system starts or stops them.

Exploitation
Other
Attacker needs
Other
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unconditional double invocation of mt7915_pci_init_hif2 on non-WED dual-HIF paths increments the global hif_idx twice, writes the PCIe RECOG_ID register twice, and leaks a device reference because only one corresponding put_device occurs on removal.

Why it matters to the business

Wireless hardware using the mt7915 driver without WED may experience reference leaks, incorrect hardware state, and potential instability or crashes during device initialization and removal.

How an attack unfolds

An attacker with local access triggers repeated module load/unload or interface bring-up sequences on affected dual-HIF hardware; the leaked reference and duplicated register writes accumulate, eventually leading to resource exhaustion or use-after-free conditions when the device is removed.

How to fix it

Update the mt76 driver to the commit that removes the unconditional mt7915_pci_init_hif2 call, ensuring the helper is invoked only inside the WED-inactive branch; rebuild and deploy the corrected kernel module.

How to confirm the fix worked

Inspect the mt7915_pci_probe path to confirm mt7915_pci_init_hif2 is called exactly once inside the WED-inactive conditional; verify hif2 remains NULL until the single initialization point and that reference counts balance on module removal.

Typical attack path

  1. Obtain local execution on a system with mt7915 dual-HIF hardware on the non-WED path
  2. Trigger repeated mt76 driver probe or interface up/down cycles
  3. Accumulate leaked device references and duplicate RECOG_ID writes
  4. Force device removal to trigger use-after-free or state corruption

How to detect it

Review kernel logs for mt7915 double-init warnings, unbalanced device reference messages, or repeated RECOG_ID register writes during probe; correlate with mt76 module load/unload events.

What your security team should do

  • Prioritize patching systems with mt7915 hardware on the non-WED path within normal maintenance windows
  • Monitor kernel oops and reference-count warnings related to mt76 during device attach/detach
  • Apply the upstream fix before enabling dual-HIF configurations in production

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915_pci_init_hif2() was called unconditionally and again inside the WED-inactive branch. The helper increments the global hif_idx, writes the PCIe RECOG_ID register and takes a get_device() reference via mt7915_pci_get_hif2(), while removal only drops one reference. On non-WED dual-hif hardware this double-incremented hif_idx, wrote RECOG_ID twice and leaked a device reference. Only the call inside the WED-inactive branch is correct; drop the unconditional one. hif2 is already initialised to NULL.

Affected packages

Ecosystem Package Introduced Fixed