CVE-2026-90374

What it actually does

The flaw allows an out-of-bounds array access or NULL pointer dereference in the mt7996 RX path when a 2-bit band_idx descriptor field contains a value of 3 or references an unpopulated phy entry.

Why it matters to the business

A local or nearby attacker could crash the wireless driver or trigger kernel instability on affected Linux systems, leading to denial of service and potential loss of network connectivity or system availability.

How an attack unfolds

An attacker crafts or manipulates a wireless frame descriptor with an invalid band_idx value (outside 0-2 or hitting a NULL phy). When the mt7996 driver processes the RX descriptor it uses the index directly without validation, resulting in an out-of-bounds read or NULL dereference that can panic the kernel.

How to fix it

Update the mt76 driver to a version that contains the band_idx validation check before indexing phys[]. Apply the upstream fix that mirrors the validation already present in mt7996_rx_get_wcid().

How to confirm the fix worked

Confirm the presence of the validation logic that rejects band_idx values outside the supported range or when the corresponding phy entry is NULL; test with crafted descriptors or review dmesg for the original oops signature after applying the update.

Typical attack path

1. Attacker obtains ability to send crafted 802.11 frames or control a malicious AP visible to the victim device
2. Victim kernel receives a frame whose descriptor contains an out-of-range band_idx
3. mt7996 RX handler indexes dev->mt76.phys[] with the invalid value
4. Kernel performs invalid memory access or dereferences NULL, causing oops or panic

How to detect it

Look in kernel logs (dmesg, journalctl) for oops or panic messages originating from mt76/mt7996 RX path functions that reference phys[] or band_idx; correlate with recent wireless frame reception events on affected hardware.

What your security team should do

• Prioritize patching systems that use mt7996-based Wi-Fi hardware as soon as vendor kernels become available
• Monitor upstream mt76 commits and distribution security advisories for the exact fixed version
• Where immediate patching is not possible, consider disabling the mt7996 driver or restricting untrusted wireless networks as a temporary mitigation