CVE-2026-90378

What it actually does

Failure to release network socket buffer (skb) when tx_prepare_skb returns an error in the mt76 mt792x SDIO transmit path causes a memory leak; the leak is triggered by dropped zero-length frames such as WNM NULL frames.

Why it matters to the business

Devices using the affected wireless hardware may gradually exhaust available memory during normal operation, leading to performance degradation, instability, or eventual crashes after prolonged use.

How an attack unfolds

An attacker with the ability to influence transmitted frames on a system using vulnerable mt792x SDIO hardware can send specially crafted zero-length frames that cause tx_prepare_skb to fail, repeatedly allocating memory without corresponding frees and exhausting resources over time.

How to fix it

Apply the upstream kernel fix that invokes ieee80211_tx_status_ext to release the skb whenever tx_prepare_skb fails in the mt76 SDIO TX path; rebuild and deploy updated kernels on all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the mt76 SDIO TX source for the ieee80211_tx_status_ext call on tx_prepare_skb failure, then test with zero-length frames and monitor for skb leaks using kernel memory accounting tools.

Typical attack path

1. Identify systems using mt792x SDIO wireless hardware
2. Send zero-length or WNM NULL frames that trigger the tx_prepare_skb error path
3. Repeat transmission to accumulate unfreed buffers and exhaust memory

How to detect it

Review kernel logs and memory statistics for repeated skb allocations without matching frees during Wi-Fi transmit activity; correlate spikes with periods of frame transmission that include zero-length frames.

What your security team should do

• Inventory systems that include mt792x SDIO wireless chips and prioritize kernel updates
• Apply the corrected kernel version as soon as it is available in your distribution
• Monitor memory usage trends on wireless-enabled hosts for unexplained growth