CVE-2026-90351: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an inconsistent half-WED configuration that crashes later. The hif2 call also re-enabled hwrromode, which the failed primary attach had just turned off.
Skip the hif2 WED setup when the primary WED device is not active.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel mt76 mt7996 Wi-Fi driver with both a primary PCIe function and the secondary hif2 WED setup can be exposed when the primary WED attachment fails during device probing.
What condition triggers the crash?
The primary WED attach must fail, after which the affected probe path still attaches wed_hif2 for the secondary function. This leaves a half-WED configuration and re-enables hwrro_mode, which can cause a later crash.
How can I tell whether a system has encountered this condition?
The relevant indicator is a failed primary WED attachment followed by hif2 WED setup during mt7996 device probing. The described outcome is an inconsistent half-WED configuration that crashes later.
What is the mitigation if an updated kernel is not immediately available?
The provided fix prevents secondary hif2 WED setup when the primary WED device is not active. No separate configuration-based workaround is provided in the available data.