Cloudanix VulnDB

CVE-2026-90355

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's Wi-Fi driver can leave wireless networking broken after a hardware reset until the system is updated.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

After full chip reset, stale valid_links bits cause mt7996_vif_link_add to short-circuit, preventing recreation of dev_info/bss_info/STA records and WCID registration; additionally, MLD index masks are not cleared, leaking indices and exhausting the allocation space on repeated resets, leaving the wireless device inoperative.

Why it matters to the business

Wireless interfaces on affected systems become non-functional after chip resets, interrupting network connectivity with potential for repeated failures on successive resets; low and stable EPSS suggests limited active exploitation risk at present.

How an attack unfolds

An attacker triggers conditions that force a full chip reset (via power events, firmware errors, or interface flaps), after which the driver fails to reinitialize links and MLD indices due to uncleared state, rendering the radio unusable without manual intervention or reboot.

How to fix it

Apply the upstream kernel patch that clears valid_links in the reset vif iterator and resets MLD index masks alongside omac_mask; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

After patching, trigger full chip resets and confirm that link structures, dev_info/bss_info/STA records, WCID registration, and MLD indices are correctly recreated without leakage or exhaustion.

Typical attack path

  1. Identify or induce conditions causing full chip reset in mt7996 hardware
  2. Allow mac80211 reconfig to replay interface and link setup
  3. Observe short-circuit in mt7996_vif_link_add due to stale valid_links
  4. Confirm absence of dev_info/bss_info/STA records and WCID registration
  5. Repeat reset to exhaust MLD index space and sustain inoperability

How to detect it

Review dmesg and kernel logs for mt76/mt7996 reset paths, failed link reconfiguration messages, or repeated MLD index allocation warnings; correlate with wireless interface becoming non-operational post-reset events.

What your security team should do

  • Prioritize kernel update for systems using mt7996 wireless hardware
  • Monitor for repeated chip resets in logs as an early indicator of impact
  • Test reset recovery behavior in lab environments before broad deployment
  • Consider temporary mitigation by avoiding unnecessary full resets where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996_vif_link_add() short-circuits when the link_id is still marked in mvif->valid_links, a state introduced for postponing link teardown to interface removal. The reset path frees the link structures without clearing those bits, so the replayed setup never re-creates dev_info/bss_info/STA records in the restarted firmware and never re-registers the link wcid, leaving the device inoperative. The reset path also leaks every allocated MLD index: per-link indices and the per-vif group/remap indices are re-allocated from scratch during reconfig, but the old bits stay set in the masks, so repeated full resets exhaust the index space. Clear valid_links in the reset vif iterator and reset the MLD index masks alongside the existing omac_mask clearing.

Affected packages

Ecosystem Package Introduced Fixed