CVE-2026-90354: wifi: mt76: mt7915: fix double hif2 init on the non-WED path
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix double hif2 init on the non-WED path
mt7915pciinithif2() was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and takes a getdevice() reference via mt7915pcigethif2(), while removal only drops one reference. On non-WED dual-hif hardware this double-incremented hifidx, wrote RECOGID twice and leaked a device reference. Only the call inside the WED-inactive branch is correct; drop the unconditional one. hif2 is already initialised to NULL.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue affects Linux kernel systems using mt7915 PCI hardware with dual HIF interfaces on the non-WED path. The described fault does not apply when WED is active.
What happens if the vulnerable initialization path is reached?
HIF2 initialization runs twice, incrementing the global hif_idx twice, writing the PCIe RECOG_ID register twice, and acquiring an extra device reference. Device removal drops only one reference, leaving a leaked reference.
Is there a configuration-based workaround if updating the kernel is not immediately possible?
Using the WED-active path avoids the described non-WED double-initialization path. The data does not provide any other workaround.