Cloudanix VulnDB

CVE-2026-90369

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain WiFi drivers on Linux could let a logged-in user accidentally or deliberately crash the whole computer or gain higher access rights.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds memory access in mt76_mmio_write_copy and mt76_mmio_read_copy when buffer length is not a multiple of four, causing reads past source or writes past destination during MMIO operations.

Why it matters to the business

Kernel-level crashes or memory corruption in affected wireless drivers can lead to system instability, denial of service, or potential local privilege escalation on Linux systems using mt76 hardware.

How an attack unfolds

An attacker with local access supplies a non-aligned length to the vulnerable copy helpers, triggering out-of-bounds access during register operations; this can corrupt adjacent kernel memory and be chained for code execution.

How to fix it

Apply the upstream kernel patch that processes aligned body data in a loop and uses a 4-byte bounce buffer for any tail bytes; rebuild and deploy updated kernel images to all affected systems.

How to confirm the fix worked

Verify the presence of the fix by inspecting the mt76_mmio.c source for the bounce-buffer tail handling logic and confirm the running kernel was built after the patch commit date.

Typical attack path

  1. Obtain local user access on a Linux system with mt76 WiFi hardware
  2. Trigger wireless operations or ioctls that invoke mt76_mmio_write_copy or mt76_mmio_read_copy with non-4-byte-aligned lengths
  3. Exploit resulting memory corruption to escalate privileges or crash the kernel

How to detect it

Review kernel logs for oops/panic entries referencing mt76_mmio_write_copy or mt76_mmio_read_copy and inspect wireless driver stack traces for buffer length anomalies.

What your security team should do

  • Prioritize kernel updates on any systems exposing mt76 wireless drivers
  • Monitor for kernel oops or panic logs related to mt76 MMIO functions
  • Restrict local user access where possible until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to ALIGN(len, 4), so a length that is not a multiple of four reads past the source buffer (write_copy) or writes past the destination (read_copy). Copy the aligned body in the loop and handle the remaining tail through a 4-byte bounce buffer, keeping the register access width unchanged.

Affected packages

Ecosystem Package Introduced Fixed