CVE-2026-90353: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
After mt7915registerextphy() succeeded, a failure of the main PHY mt7915initdebugfs() or mt7915coredumpregister() unwound through freephy2, which called ieee80211freehw() on the ext PHY hw while it was still registered with mac80211, since mt76unregisterdevice() only unregisters the main hw. Unregister the ext PHY (thermal + phy + hw) first and skip the redundant free.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this occur?
The issue is limited to an initialization error path after the external PHY has registered successfully and either main-PHY debugfs initialization or coredump registration subsequently fails.
What cleanup behavior does the fix change?
The fix unregisters the external PHY's thermal, PHY, and hardware registrations before freeing it. It also avoids the redundant free that could release external-PHY hardware while it remained registered with mac80211.