CVE-2026-90381

What it actually does

Improper handling of ieee80211_vif_chanctx_switch structures carrying channel contexts from different bands during rapid multi-radio channel switches in mt76_switch_vif_chanctx(), resulting in memory corruption within the Linux kernel mt76 wireless driver.

Why it matters to the business

Potential for remote code execution or denial of service on Linux systems using mt76-based Wi-Fi hardware, disrupting wireless connectivity and exposing devices on local networks to compromise without authentication.

How an attack unfolds

An attacker positioned on the adjacent network triggers rapid channel switches across multiple radios carrying mixed-band contexts; the flawed handler in mt76_switch_vif_chanctx() mishandles the structures, corrupting kernel memory that the attacker then leverages for arbitrary code execution.

How to fix it

Apply the upstream Linux kernel patch that reworks mt76_switch_vif_chanctx() to correctly handle differing-band channel contexts; upgrade to a kernel release containing this fix and rebuild any out-of-tree mt76 modules.

How to confirm the fix worked

Confirm the mt76 driver source contains the updated mt76_switch_vif_chanctx() logic that explicitly checks band differences; verify no oops or corruption traces reference the old handler under multi-radio load; test with synthetic channel-switch workloads across bands.

Typical attack path

1. Attacker gains adjacent-network proximity to target Wi-Fi radios
2. Crafted 802.11 frames or management traffic force repeated channel context switches on different bands
3. mt76_switch_vif_chanctx() processes mixed-band contexts without proper validation
4. Memory corruption occurs in kernel structures
5. Attacker pivots corruption into code execution or crash

How to detect it

Search kernel logs and crash dumps for mt76 module oopses or warnings mentioning vif_chanctx or band mismatches during channel switches; inspect auditd or syslog entries for unexpected mt76 process behavior or wireless stack faults.

• mt76_switch_vif_chanctx
• ieee80211_vif_chanctx_switch
• channel context with different bands

What your security team should do

• Prioritize kernel updates for any mt76 Wi-Fi devices within 30 days
• Restrict adjacent-network access to Wi-Fi management frames where feasible
• Monitor kernel logs for mt76-related crashes indicating failed channel context handling
• Maintain an inventory of all mt76-based hardware and track vendor backports