CVE-2026-90357

What it actually does

Use-after-free in the mt7915 driver caused by leaving a TWT flow entry linked in dev->twt_list after an MCU rejection; the flow slot is later reused and memset while still on the list, corrupting the list and leaving dangling pointers that mt7915_mac_twt_sched_list_add walks during station removal.

Why it matters to the business

Wireless devices using mt7915 hardware can experience kernel memory corruption, leading to crashes, denial of service, or potential remote code execution over the local network, disrupting connectivity for users and infrastructure relying on these chips.

How an attack unfolds

An attacker on the adjacent network triggers TWT agreement setup that the firmware rejects; the resulting error path leaves the flow linked, allowing subsequent reuse of the slot to corrupt the list and enabling arbitrary memory access or crashes when the list is later walked.

How to fix it

Update to a kernel containing the fix that unlinks the TWT flow on MCU rejection error paths; apply the latest stable Linux kernel patches for the mt76/mt7915 driver.

How to confirm the fix worked

Confirm the patch is present by inspecting the mt7915 TWT error handling code for the unlink call before returning on MCU rejection; test by forcing TWT agreement rejection and verifying no list corruption occurs on subsequent station removal.

Typical attack path

1. Attacker associates or communicates on the same wireless network as the victim mt7915 device
2. Attacker induces a TWT agreement request that the MCU rejects
3. Kernel leaves the flow entry linked without setting flowid_mask
4. Flow slot is reused and zeroed while still on twt_list, corrupting the list
5. Station removal or scheduler walk triggers use of the dangling entry, causing memory corruption or crash

How to detect it

Look in kernel logs for mt76/mt7915 TWT-related warnings, list corruption messages, or use-after-free reports during station removal or TWT scheduling; monitor for unexpected kernel panics on wireless interfaces.

What your security team should do

• Prioritize kernel updates for all systems using mt7915 hardware within the next patching cycle
• Monitor upstream Linux kernel changelogs for mt76 driver fixes
• Limit exposure by restricting adjacent-network access where possible until patched