Cloudanix VulnDB

CVE-2026-90373

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in certain Wi-Fi chips could let wireless connections become unreliable or cause the system to crash when interfaces are added and removed at the same time.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in mt7915_remove_interface allows concurrent wcid mask modification without the mt76 mutex while the RCU pointer is still visible, enabling double allocation, index reuse, or subsequent NULL wipe of a live wcid entry.

Why it matters to the business

Wireless interfaces on affected mt7915 hardware may experience allocation failures, dropped connections, or kernel instability during interface add/remove operations, particularly on dual-band configurations.

How an attack unfolds

An attacker triggers rapid add/remove of wireless interfaces on a DBDC device so that one thread clears the wcid mask bit outside the mutex while another thread performs allocation; the timing window permits reuse of the same index and later corruption when the RCU pointer is cleared.

How to fix it

Apply the upstream fix that moves the wcid mask clear inside the existing mutex section after the RCU pointer is cleared; rebuild and deploy the patched kernel on all mt7915-based systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the mt7915_remove_interface function for the mutex-protected clear after rcu_assign_pointer; test by exercising concurrent interface operations on DBDC hardware and verify no wcid reuse warnings appear in dmesg.

Typical attack path

  1. attacker gains local access or controls a process that can manage wireless interfaces
  2. attacker issues concurrent add_interface and remove_interface calls across bands
  3. race window allows mask bit to be cleared without lock and RCU pointer to be overwritten
  4. allocator hands out duplicate wcid index or published wcid is later nulled
  5. subsequent use of the corrupted wcid produces driver malfunction or memory corruption

How to detect it

Review kernel logs for mt76 wcid allocation warnings, RCU use-after-free traces, or driver crashes during interface management; correlate with wireless interface creation events on multi-band hardware.

What your security team should do

  • Prioritize kernel update for any system using mt76/mt7915 wireless drivers
  • Monitor vendor backports for stable and LTS kernels
  • Restrict unprivileged users from creating or removing wireless interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915_remove_interface() cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the allocators, which all run under dev->mt76.mutex; on DBDC the two wiphys share one mt76_dev, so this raced add_interface/sta_add on the other band and could leak or double-hand-out a wcid. Clearing the bit before the RCU pointer also let a concurrent allocation reuse the index and publish its wcid, which the subsequent NULL assignment then wiped. Move the clear into the existing mutex section, after the RCU pointer is cleared.

Affected packages

Ecosystem Package Introduced Fixed