CVE-2026-90349: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx()
When mac80211 leaves the link unspecified, mt7996tx() substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->linkconf[], mvif->mt76.link[] and sta->link[], all of which hold IEEE80211MLDMAXNUMLINKS (15) entries.
Clamp the primary link id to the default link before using it, and use the clamped value for the linksta fallback as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Clamp the primary link id to the default link before using it, and use IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added.
Linux kernel (mac80211/mt76 mt7996) IEEE80211_LINK_UNSPECIFIED = 0xf - Configuration
Ensure the link array usage is limited to IEEE80211_MLD_MAX_NUM_LINKS (15) entries so mt7996_tx() does not index vif->link_conf[], mvif->mt76.link[], or sta->link[] out of bounds.
Linux kernel (mac80211/mt76 mt7996) IEEE80211_MLD_MAX_NUM_LINKS entry limit = 15
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel with the mt76 mt7996 Wi-Fi driver are affected when transmit handling reaches mt7996_tx() while the mac80211 link is unspecified and no link has yet been added.
What condition triggers the out-of-bounds access?
mac80211 must leave the link unspecified, causing mt7996_tx() to use a station or vif primary link ID of IEEE80211_LINK_UNSPECIFIED (0xf). That value is then used as an unchecked index into link arrays that contain 15 entries.
What can be done if the fix cannot be applied immediately?
The provided data does not identify a configuration workaround. The available remediation is to apply a kernel update containing the fix that clamps the primary link ID to the default link before indexing the arrays.