Cloudanix VulnDB

CVE-2026-90375

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain WiFi hardware drivers can stop wireless devices from sending data after using multiple radio links, requiring restarts to fix.

Exploitation
Adjacent Network
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect wcid reassignment in __mt76_tx_queue_skb causes non_aql_packets counters to be incremented on one link's wcid and decremented on another's for MLO stations, allowing a counter to exceed MT_MAX_NON_AQL_PKT and permanently block the TX scheduler for that station.

Why it matters to the business

Wireless clients on affected mt76 hardware can be permanently prevented from transmitting, causing loss of connectivity for stations using multiple links and requiring device resets or reboots to restore service.

How an attack unfolds

An attacker establishes an MLO connection and transmits frames on a secondary link while the primary link's wcid is used for accounting; repeated transmissions inflate the non_aql_packets counter on the wrong wcid until the scheduler threshold is crossed and service is refused.

How to fix it

Apply the upstream kernel patch that removes the wcid reassignment in __mt76_tx_queue_skb and ensures accounting uses the transmission wcid. Rebuild and deploy the fixed kernel on all affected mt76-based devices.

How to confirm the fix worked

Confirm the patch is present by inspecting the mt76 tx.c source for removal of the sta->drv_priv wcid override; test MLO station traffic and verify non_aql_packets counters remain balanced across links without exceeding the threshold.

Typical attack path

  1. Associate with an mt76 AP using MLO and multiple links
  2. Transmit data frames on a link different from the setup link
  3. Trigger repeated TX path accounting mismatches via crafted or high-volume traffic
  4. Observe the non_aql_packets counter exceed the limit on the mismatched wcid
  5. Cause the TX scheduler to permanently refuse service to the station

How to detect it

Review kernel logs for mt76 TX scheduler refusals or non_aql_packets warnings; correlate with MLO station activity and sudden loss of transmit capability on affected hardware.

What your security team should do

  • Prioritize patching mt76 WiFi drivers in all Linux kernels within 30 days
  • Monitor for stations that stop transmitting and require reset as an interim indicator
  • Restrict MLO usage to trusted clients until patches are deployed if feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations __mt76_tx_queue_skb() overrides the wcid passed by the driver with sta->drv_priv, so the wcid might incorrectly be changed after TX, causing wcid->non_aql_packets to be counted on the wrong wcid. For example, on the AP side, if a station's setup link is the 5G link and the station uses 2G to transmit a frame, the value of non_aql_packets is increased on the 5G wcid but decreased on the 2G wcid. Once the inflated counter exceeds MT_MAX_NON_AQL_PKT, the TX scheduler permanently refuses to service the station. Drop the reassignment and account on the wcid used for transmission. This also records the actual wcid in the queue entry.

Affected packages

Ecosystem Package Introduced Fixed