CVE-2026-90350: wifi: mt76: reject out-of-range link ids in mt76_vif_link()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: reject out-of-range link ids in mt76viflink()
mt76viflink() indexes mvif->link[] without validating linkid, but callers pass mvif->deflinkid / msta->deflinkid, which hold IEEE80211LINKUNSPECIFIED (0xf) until the first link has been added. Since IEEE80211MLDMAXNUMLINKS is 15, that reads one element past the end of the array, aliasing mt76vifdata.offchannellink.
Reachable via mt7996settsf()/mt7996offsettsf() and mt7996netfillforwardpath(). Bounds check linkid and return NULL, matching mt7996stalink() and mt7996stalinkprotected().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mt76 Wi-Fi driver are exposed where the affected mt7996 code paths can invoke mt76_vif_link() before a link has been added. The described reachable paths are mt7996_set_tsf(), mt7996_offset_tsf(), and mt7996_net_fill_forward_path().
What condition triggers the out-of-bounds access?
The condition occurs when mvif->deflink_id or msta->deflink_id still contains IEEE80211_LINK_UNSPECIFIED (0xf), which is its value until the first link is added. That value is outside the valid link array range and causes mt76_vif_link() to read one element past mvif->link[].
What is the impact of the invalid array access?
The out-of-range read aliases the mt76_vif_data.offchannel_link field. The provided information identifies an out-of-bounds read but does not specify further security impact or exploitation requirements.