Cloudanix VulnDB

CVE-2026-90372

High · 7.1

CVSS

7.1

EPSS

0.4%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless driver bug can make certain network connections unstable when a device receives unusual capability data from another wireless device.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An invalid peer VHT/HE MCS map with all fields set to 0x3 causes the NSS loop in mt7915_mcu_get_sta_nss to exit with nss==0, returning 255 which is then written into firmware sta_rec_bf beamforming state.

Why it matters to the business

Wireless devices using affected MediaTek MT7915 chips may experience beamforming misconfiguration leading to connection instability or degraded performance on local networks.

How an attack unfolds

An attacker on the same wireless network sends a crafted association or capability frame containing a VHT/HE MCS map with no supported spatial streams, causing the driver to compute and store an invalid NSS value of 255 in firmware beamforming records.

How to fix it

Apply the upstream kernel patch that clamps the NSS result to zero before writing to firmware sta_rec_bf fields; rebuild and deploy updated kernels on all systems using the mt76 mt7915 driver.

How to confirm the fix worked

Inspect the mt7915_mcu_get_sta_nss function to confirm the addition of an explicit clamp returning 0 when nss==0, and test association with a peer advertising no supported spatial streams.

Typical attack path

  1. Establish wireless adjacency with an affected mt7915 device
  2. Transmit a peer capabilities frame with all VHT/HE MCS fields set to 0x3
  3. Trigger mt7915_mcu_get_sta_nss during station record processing
  4. Cause 255 to be written into sta_rec_bf firmware fields

How to detect it

Examine kernel and firmware logs for mt7915 sta_rec_bf writes containing the value 255, and monitor wireless association frames carrying all-zero VHT/HE MCS maps on affected hardware.

What your security team should do

  • Prioritize kernel updates containing the mt76 NSS clamp fix on all mt7915-based systems
  • Review wireless driver logs for unexpected sta_rec_bf values after patching
  • Consider temporary reduction of beamforming features if patches cannot be applied immediately

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss If a peer's VHT/HE MCS map has no supported spatial stream (all fields 0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255), which was then written into the firmware sta_rec_bf beamforming fields. Clamp the result to 0.

Affected packages

Ecosystem Package Introduced Fixed