CVE-2026-90371

What it actually does

Race condition in mt76 wireless driver RXDMAD_C buffer recycling from RRO page pools bound to a separate NAPI, allowing concurrent access and potential use-after-free or memory corruption instead of safe non-direct recycling.

Why it matters to the business

Remote attackers on the same wireless network could crash affected Linux systems or gain code execution, disrupting wireless-dependent operations and requiring urgent kernel updates across device fleets.

How an attack unfolds

An attacker within wireless range transmits crafted 802.11 frames that exercise the RX path; the resulting concurrent buffer operations between NAPIs trigger the race, enabling memory corruption that can be leveraged for privilege escalation or denial of service.

How to fix it

Apply the upstream kernel patch that routes RXDMAD_C recycling through the non-direct path already used for WED RX queues; rebuild and deploy updated kernels on all affected systems.

How to confirm the fix worked

Confirm the mt76 driver source contains the change to non-direct page-pool recycling for RXDMAD_C; perform wireless RX stress testing under concurrent NAPI load to verify absence of races.

Typical attack path

1. Gain proximity to target wireless interface
2. Transmit specially crafted frames targeting mt76 RX queues
3. Trigger concurrent NAPI access to RXDMAD_C page pools
4. Exploit resulting memory corruption for code execution or crash

How to detect it

Search kernel logs and crash dumps for mt76 driver warnings or page-pool errors during high wireless receive traffic; correlate with system instability coinciding with wireless activity.

• RXDMAD_C
• RRO data queues
• mt76.*page pool recycle
• direct page-pool recycle

What your security team should do

• Prioritize kernel updates for all Linux systems using mt76 wireless hardware
• Restrict wireless network exposure until patches are applied
• Enable kernel crash reporting and monitor for mt76-related panics