CVE-2026-90367
High · 8.8CVSS
8.8
EPSS
0.4%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A timing flaw in certain WiFi hardware drivers can let network activity corrupt internal data structures, potentially crashing the wireless connection or the whole system.
- Exploitation
- Adjacent Network
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in mt7996 reset path allows MT76_RESET bit and tx worker to be toggled without the mt76 mutex, enabling concurrent DMA ring resets that corrupt descriptors or tokens when an L1 SER races a channel switch.
Why it matters to the business
Wireless network instability or crashes on affected hardware can interrupt connectivity, cause packet loss, or trigger kernel-level faults in devices relying on mt7996 WiFi.
How an attack unfolds
An attacker on the adjacent network triggers repeated channel switches while simultaneously inducing L1 SER events; the missing mutex allows the tx worker to be re-enabled and MT76_RESET cleared during active DMA reset, corrupting internal state.
How to fix it
Apply the upstream fix that acquires dev->mt76.mutex before calling mt76_worker_disable in mt7996_mac_reset_work; rebuild and deploy updated kernel images containing the corrected mt76 driver.
How to confirm the fix worked
Confirm the mutex acquisition precedes worker disable in mt7996_mac_reset_work source; test concurrent channel-switch and L1 SER workloads to verify absence of descriptor corruption or token leaks.
Typical attack path
- Gain adjacent-network position to the target WiFi interface
- Force repeated channel-switch operations via 802.11 management frames
- Induce L1 SER events through crafted traffic or hardware signals
- Race window allows concurrent reset and worker re-enable, corrupting descriptors
- Resulting state leads to crashes, DoS, or memory corruption
How to detect it
Inspect kernel logs for mt76 reset-related warnings, descriptor corruption messages, or unexpected MT76_RESET bit changes during channel-switch activity; correlate with WiFi interface resets.
What your security team should do
- Prioritize kernel updates for all systems using mt7996 hardware
- Monitor for kernel oops or WiFi reset loops in system logs
- Limit exposure by restricting adjacent-network access where feasible until patched
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER mt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex. An L1 SER racing a channel switch could therefore have the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens. Take the mutex before disabling the worker, as mt7915 does.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|