Cloudanix VulnDB

CVE-2026-90380

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux Wi-Fi drivers can let nearby attackers crash the computer or potentially take it over by interfering with how the system handles wireless connections.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mt76_rx_poll_complete triggered by a race where an STA is removed via RCU but the rx_status structure retains a dangling pointer to the wcid; the fix nulls links' wcid pointers for MLD stations in mt7925_sta_pre_rcu_remove.

Why it matters to the business

Systems using affected MediaTek mt792x Wi-Fi hardware in Linux kernels face risk of crashes, kernel panics, or potential code execution, resulting in service disruption and possible full host compromise 37 days after disclosure with no known active exploitation.

How an attack unfolds

An attacker on an adjacent network triggers rapid STA association and removal (for example via deauthentication or roaming events) while concurrent RX polling is active, so that mt76_rx_poll_complete dereferences the freed wcid pointer left in rx_status.

How to fix it

Apply the upstream fix that sets wcid pointers to NULL inside mt7925_sta_pre_rcu_remove before the RCU grace period; rebuild and deploy updated Linux kernels containing the resolution for mt76/mt792x.

How to confirm the fix worked

Confirm the presence of the mt7925_sta_pre_rcu_remove nulling change in the running kernel source or verify that KASAN no longer reports invalid-access at mt76_rx_poll_complete+0x280 during STA removal races.

Typical attack path

  1. Establish or force an MLD STA association on mt792x hardware
  2. Trigger RCU removal of the STA (deauth, disassociate, or roaming)
  3. Induce concurrent napi RX processing in mt76_dma_rx_poll
  4. mt76_rx_poll_complete accesses the stale wcid pointer leading to invalid memory access

How to detect it

Search kernel logs and dmesg for KASAN invalid-access reports that name mt76_rx_poll_complete or reference the call trace through mt76_dma_rx_poll and napi_threaded_poll; also look for any mention of mt7925_sta_pre_rcu_remove in crash dumps.

  • mt76_rx_poll_complete+0x280/0x470
  • BUG: KASAN: invalid-access in mt76_rx_poll_complete
  • mt7925_sta_pre_rcu_remove
  • kasan_report+0xe0/0x144

What your security team should do

  • Prioritize kernel updates for all systems exposing mt792x Wi-Fi interfaces
  • Enable KASAN or similar memory debugging on test systems to reproduce the race
  • Monitor kernel logs for mt76-related KASAN reports until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete A use-after-free issue occurs in mt76_rx_poll_complete due to a race condition. The STA has already been removed, but the rx_status still had a pointer to the wcid in the STA. Set the links' wcid pointers to be NULL for a MLD in mt7925_sta_pre_rcu_remove() BUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470 Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0xc8 print_report+0x1b8/0x710 kasan_report+0xe0/0x144 do_bad_area+0x120/0x260 do_tag_check_fault+0x20/0x34 do_mem_abort+0x54/0xa8 el1_abort+0x3c/0x5c el1h_64_sync_handler+0x40/0xcc el1h_64_sync+0x7c/0x80 mt76_rx_poll_complete+0x280/0x470 mt76_dma_rx_poll+0x114/0x51c mt792x_poll_rx+0x60/0xf8 napi_threaded_poll_loop+0xe0/0x450 napi_threaded_poll+0x80/0x9c kthread+0x11c/0x158 ret_from_fork+0x10/0x20

Affected packages

Ecosystem Package Introduced Fixed