CVE-2026-90350: wifi: mt76: reject out-of-range link ids in mt76_vif_link()

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: reject out-of-range link ids in mt76viflink()

mt76viflink() indexes mvif->link[] without validating linkid, but callers pass mvif->deflinkid / msta->deflinkid, which hold IEEE80211LINKUNSPECIFIED (0xf) until the first link has been added. Since IEEE80211MLDMAXNUMLINKS is 15, that reads one element past the end of the array, aliasing mt76vifdata.offchannellink.

Reachable via mt7996settsf()/mt7996offsettsf() and mt7996netfillforwardpath(). Bounds check linkid and return NULL, matching mt7996stalink() and mt7996stalinkprotected().