Cloudanix VulnDB

CVE-2026-90368

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain Wi-Fi chips can leave behind small memory leaks or cause crashes if network interface setup fails.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to unwind partial state in mt7915_add_interface when mt76_wcid_alloc fails leaves vif_mask/omac_mask bits set, retains a firmware device entry, and leaves a dangling monitor_vif pointer that mac80211 will free without a subsequent remove_interface call, enabling permanent resource leaks and potential stale-pointer dereference in testmode paths.

Why it matters to the business

Wireless interfaces on affected mt7915 hardware may leak kernel resources over repeated attach failures, leading to gradual memory exhaustion or crashes during driver reloads and test operations; low exploitability keeps immediate operational risk modest but still requires prompt patching on any Linux-based wireless systems.

How an attack unfolds

An attacker with local access or the ability to trigger repeated interface addition failures (via crafted 802.11 frames or testmode commands) can exhaust mask indices and firmware slots or cause a later testmode operation to dereference the freed monitor_vif pointer, resulting in a kernel crash or memory corruption.

How to fix it

Update to a Linux kernel containing the referenced commit that adds proper error unwinding in mt7915_add_interface; rebuild and deploy the fixed kernel on all affected mt7915-based systems.

How to confirm the fix worked

Inspect the mt7915.c source for the error-unwind patch; verify the running kernel version contains the fix or run a targeted test that exercises add_interface failure followed by testmode operations without observing leaks or dereferences.

Typical attack path

  1. Obtain local or adjacent network access to the wireless device
  2. Trigger repeated mt7915_add_interface calls that fail at mt76_wcid_alloc
  3. Observe leaked mask bits and stale monitor_vif pointer
  4. Invoke testmode operations that dereference the stale pointer

How to detect it

Review kernel logs for repeated mt76_wcid_alloc failures followed by testmode activity; examine memory usage trends on wireless interfaces and watch for oops or panic traces involving monitor_vif after interface addition attempts.

What your security team should do

  • Prioritize kernel updates on any systems using mt7915 Wi-Fi hardware within the next maintenance window
  • Monitor upstream stable kernel releases for backports of the unwind fix
  • Limit exposure by restricting local testmode access until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unwind state on add_interface failure When mt76_wcid_alloc() fails, mt7915_add_interface() returned without clearing the vif_mask/omac_mask bits it had already set, without removing the firmware dev info added earlier, and without clearing a monitor_vif pointer to the vif mac80211 is about to free. mac80211 does not call remove_interface() for a failed add, so the indices and firmware dev entry leaked permanently and testmode could dereference the stale monitor_vif. Add a proper error unwind.

Affected packages

Ecosystem Package Introduced Fixed