CVE-2026-90377

What it actually does

Incorrect RX data frame queuing for RRO 3.0 in the mt76 driver places frames on the data queue instead of the indicator queue, causing them to remain unprocessed until the wrong NAPI context runs and resulting in stalls plus packet reordering.

Why it matters to the business

Wireless devices using affected mt76 hardware may experience degraded network throughput, increased latency, or unreliable data delivery until the driver is updated.

How an attack unfolds

An attacker sends a sustained stream of wireless frames that trigger the RRO 3.0 data path; because frames are left on the wrong queue, processing is delayed or reordered, amplifying any existing race condition in RX handling.

How to fix it

Update the Linux kernel to a version containing the fix for the mt76 RRO 3.0 RX queuing logic; rebuild and deploy the updated kernel module on all affected systems.

How to confirm the fix worked

Confirm the mt76 driver version contains the commit that routes RRO 3.0 released frames to the MT_RXQ_RRO_IND list and verify that RX NAPI processing occurs exclusively in the indicator queue context.

Typical attack path

1. Target a system running an unpatched mt76 driver with RRO 3.0 enabled
2. Generate high-rate RX traffic that exercises the RRO data queue path
3. Observe or induce stalls and reordering in the indicator queue NAPI context
4. Leverage resulting packet loss or latency for denial-of-service or traffic analysis

How to detect it

Inspect kernel logs for mt76 RX queue warnings, stalled NAPI polling messages, or repeated reordering events on systems with mt76 hardware; correlate with wireless interface packet counters showing unexpected latency spikes.

What your security team should do

• Prioritize kernel updates on any systems using mt76 Wi-Fi hardware with RRO 3.0
• Monitor upstream stable kernel releases for the referenced fix and schedule testing
• Temporarily disable RRO 3.0 via driver parameters if immediate patching is not feasible