CVE-2026-90355: wifi: mt76: mt7996: clear stale link state on full reset
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: clear stale link state on full reset
After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd() short-circuits when the linkid is still marked in mvif->validlinks, a state introduced for postponing link teardown to interface removal. The reset path frees the link structures without clearing those bits, so the replayed setup never re-creates devinfo/bssinfo/STA records in the restarted firmware and never re-registers the link wcid, leaving the device inoperative.
The reset path also leaks every allocated MLD index: per-link indices and the per-vif group/remap indices are re-allocated from scratch during reconfig, but the old bits stay set in the masks, so repeated full resets exhaust the index space.
Clear validlinks in the reset vif iterator and reset the MLD index masks alongside the existing omacmask clearing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On a full chip reset, modify the reset/vif iterator logic to clear stale link state by clearing mvif->valid_links ("Clear valid_links in the reset vif iterator") and reset the MLD index ("reset the MLD index") so replayed interface/link setup does not exhaust per-link/per-vif indices or leave stale masks/links.
Linux kernel mt76/mt7996 (wifi: mt76: mt7996: clear stale link state on full reset) reset path: clear valid_links in reset vif iterator and reset the MLD index = cleared
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Linux kernel systems using the mt76 mt7996 Wi-Fi driver when the device undergoes a full chip reset. It is specific to the mt7996 reset and mac80211 reconfiguration path, not to all Linux Wi-Fi devices.
What is the operational impact after a full reset?
Reconfiguration can fail to recreate firmware device, BSS, and station records or re-register the link WCID. This can leave the Wi-Fi device inoperative after the reset.
Why are repeated full resets particularly problematic?
The reset path can leave previously allocated MLD index bits marked as in use while reconfiguration allocates new indices. Repeated full resets can therefore exhaust the available MLD index space.