Cloudanix VulnDB

CVE-2026-90379

High · 8.8

CVSS

8.8

EPSS

0.4%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain Linux Wi-Fi drivers can cause the entire computer to crash when the wireless hardware encounters a connection error on the PCIe bus.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

When PCIe AER error causes bus hang, hardware register reads return 0xFFFFFFFF which is used unchecked as DMA queue index, corrupting q->head/q->tail and triggering invalid memory access on q->desc[] or q->entry[].

Why it matters to the business

System crashes and loss of Wi-Fi functionality on affected Linux devices during PCIe errors, resulting in unplanned downtime and potential data loss in environments relying on mt7921 hardware.

How an attack unfolds

An attacker with adjacent network access induces or waits for a PCIe AER error on the mt7921 device; the resulting bus hang returns 0xFFFFFFFF on register reads; the driver passes this value as a queue index without validation, corrupting DMA state and causing kernel paging fault and crash.

How to fix it

Apply the upstream kernel fix that validates DMA indices before use, clamps out-of-range values such as 0xFFFFFFFF, checks the bus_hung flag in mt7921_mac_reset_work, rejects MCU messages while hung, and installs no-op bus operations after unrecoverable AER errors.

How to confirm the fix worked

Reproduce AER error conditions in a test environment and confirm absence of the described kernel paging fault and call trace involving mt76_dma_add_buf; verify presence of bus_hung checks and index validation in the driver source.

Typical attack path

  1. Trigger or observe PCIe AER error on mt7921 Wi-Fi device
  2. Bus hang forces all register reads to return 0xFFFFFFFF
  3. mt76_dma_add_buf or mt76_dma_rx_fill uses the value as queue index
  4. q->head or q->tail is corrupted leading to out-of-bounds descriptor access
  5. Kernel paging request fault occurs resulting in panic

How to detect it

Search kernel logs and crash dumps for stack traces containing mt76_dma_add_buf, mt76_dma_rx_fill, mt7921_wpdma_reset, or mt7921_mac_reset_work together with messages about kernel paging request at invalid addresses or 0xFFFFFFFF values read from hardware.

  • mt76_dma_add_buf+0x124/0x188
  • Unable to handle kernel paging request at virtual address
  • mt7921_mac_reset_work
  • bus_hung
  • mt76_dma_rx_reset

What your security team should do

  • Prioritize kernel updates containing the mt76 AER handler fix on all systems using mt7921 hardware
  • Monitor dmesg and kernel logs for AER error reports and mt76 reset attempts
  • Consider disabling affected Wi-Fi devices or using alternative hardware in high-availability environments until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash When an AER error occurs and the bus is hung, the register reads return 0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in an invalid memory access when accessing q->desc[] or q->entry[]. Unable to handle kernel paging request at virtual address ffffffc01099eac0 pc : mt76_dma_add_buf+0x124/0x188 [mt76] lr : mt76_dma_rx_fill+0x11c/0x1d8 [mt76] sp : ffffffc016d9bbf0 x29: ffffffc016d9bc10 x28: 0000000000000000 x27: 0000000000000000 x26: ffffffb7855e50b8 x25: ffffffb80d04f000 x24: 0000000000000000 x23: 0000000000000ec0 x22: ffffffb796803648 x21: ffffffb796801f80 x20: ffffffb7968035f8 x19: 0000000000000ec0 x18: 0000000000000000 x17: 000000004ec00000 x16: 000000000ec00000 x15: ffffffc01099eac0 x14: 000000004ec00000 x13: 00000000ffc5a000 x12: ffffffc016d9bc32 x11: 00000000ffffffff x10: 0000000000000002 x9 : 0000000000000000 x8 : 000000000000b4ac x7 : 0000000000000a20 x6 : ffffffb6c1806400 x5 : 0000000000000000 x4 : ffffffb80d04f000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : 000000000ec04000 x0 : ffffffb7968035f8 Call trace: mt76_dma_add_buf+0x124/0x188 [mt76 (HASH:1029 4)] mt76_dma_rx_reset+0xe8/0xfc [mt76 (HASH:1029 4)] mt7921_wpdma_reset+0x188/0x1b0 [mt7921e (HASH:ee48 5)] mt7921e_mac_reset+0x128/0x418 [mt7921e (HASH:ee48 5)] mt7921_mac_reset_work+0xac/0x1a8 [mt7921_common (HASH:f721 6)] process_one_work+0x188/0x514 worker_thread+0x12c/0x300 kthread+0x140/0x1fc ret_from_fork+0x10/0x30 Fix the invalid memory access by validating the DMA index read from the hardware before it is used as a queue index. An out-of-range value, such as the 0xFFFFFFFF returned while the bus is hung, is now clamped so it can no longer corrupt q->head or q->tail. In addition, check the bus_hung flag in mt7921_mac_reset_work() before attempting the reset sequence, reject MCU messages while the bus is hung, and install no-op bus operations when an unrecoverable AER error is detected, preventing further invalid hardware accesses. Due to hardware limitations - such as the lack of a connected hardware reset pin or the absence of host re-probe functionality - affected Wi-Fi devices may not fully recover to a normal operational state after certain errors, even with AER enabled.

Affected packages

Ecosystem Package Introduced Fixed