CVE-2026-90356

What it actually does

Use-after-free in mt76 mt7996 wifi driver: mt7996_mac_reset_vif_iter queues vif links for kfree_rcu while dev->wcid[] retains pointers to embedded wcids; subsequent mt76_reset_device dereferences the freed memory during mt76_wcid_cleanup if an RCU grace period passes.

Why it matters to the business

Kernel instability or potential code execution on affected Linux wifi devices can cause system crashes, service outages, and security exposure in wireless infrastructure.

How an attack unfolds

An attacker with local access or ability to trigger device reset conditions forces a full mt76_reset_device path; the window between link freeing and wcid cleanup allows reuse of freed memory, leading to arbitrary kernel operations.

How to fix it

Apply the upstream fix that reorders operations to invoke mt76_reset_device before queuing vif links for freeing; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm kernel source contains the corrected reset ordering in mt7996; boot test the driver under reset conditions and verify no UAF reports in KASAN or kernel logs.

Typical attack path

1. Trigger conditions that invoke mt7996 full reset path
2. mt7996_mac_reset_vif_iter frees non-default vif links via kfree_rcu while wcid pointers remain live
3. mt76_reset_device dereferences stale wcid entries and calls mt76_wcid_cleanup on freed objects
4. RCU grace period elapses allowing attacker-controlled reuse of the freed memory

How to detect it

Inspect kernel logs for mt76 reset sequences followed by use-after-free warnings or KASAN reports; examine crash dumps for mt76_wcid_cleanup operating on freed vif link memory.

What your security team should do

• Prioritize kernel update on all mt7996-based wireless systems
• Monitor for reset-related crashes in wifi drivers
• Apply defense-in-depth with kernel hardening features such as KASAN or hardened RCU configs where feasible