Cloudanix VulnDB

CVE-2026-90366

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain wireless network drivers can cause computers or routers to crash when changing Wi-Fi channels under specific advanced network settings.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient reservation of beacon template space for dual TLV entries during active CSA countdown causes the offload command to exceed MT7996_MAX_BSS_OFFLOAD_SIZE, resulting in skb_over_panic when MBSSID is enabled and the beacon is near maximum size.

Why it matters to the business

Systems using affected wireless hardware may experience unexpected kernel crashes and loss of network connectivity during channel switch operations, leading to downtime on Wi-Fi access points or client devices with low likelihood of exploitation given current threat data.

How an attack unfolds

An attacker with control over Wi-Fi configuration triggers a CSA countdown while MBSSID is active and a large beacon template is in use; the driver emits two countdown TLVs instead of the single reserved slot, overflowing the skb buffer and causing a panic. No named threat actors or campaigns are associated with this issue.

How to fix it

Apply the upstream kernel patch that increases MT7996_BEACON_UPDATE_SIZE to reserve space for both countdown TLVs; rebuild and deploy updated kernel images to all affected devices.

How to confirm the fix worked

Confirm the presence of the space reservation change in mt76/mt7996 code and verify that beacon offload commands no longer exceed the maximum size under CSA+MBSSID conditions; test with maximum beacon templates.

Typical attack path

  1. Enable MBSSID and configure a near-maximum size beacon template on mt7996 hardware
  2. Initiate a CSA countdown that activates mt7996_mcu_beacon_cntdwn()
  3. Driver emits both CSA countdown and CCA-abort BCC TLV entries
  4. Command size exceeds MT7996_MAX_BSS_OFFLOAD_SIZE and triggers skb_over_panic

How to detect it

Search kernel logs and crash dumps for skb_over_panic messages originating from mt76 driver paths, especially around beacon or CSA handling; correlate with mt7996_mcu_beacon_cntdwn calls.

  • skb_over_panic
  • mt7996_mcu_beacon_cntdwn
  • MT7996_BEACON_UPDATE_SIZE
  • MT7996_MAX_BSS_OFFLOAD_SIZE

What your security team should do

  • Prioritize patching kernel wifi drivers on any mt7996-based access points or clients
  • Monitor for skb_over_panic events in kernel logs on wireless infrastructure
  • Limit MBSSID usage with large beacons until patches are applied where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic(). Reserve room for both countdown TLVs.

Affected packages

Ecosystem Package Introduced Fixed