CVE-2026-90355: wifi: mt76: mt7996: clear stale link state on full reset
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: clear stale link state on full reset
After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd() short-circuits when the linkid is still marked in mvif->validlinks, a state introduced for postponing link teardown to interface removal. The reset path frees the link structures without clearing those bits, so the replayed setup never re-creates devinfo/bssinfo/STA records in the restarted firmware and never re-registers the link wcid, leaving the device inoperative.
The reset path also leaks every allocated MLD index: per-link indices and the per-vif group/remap indices are re-allocated from scratch during reconfig, but the old bits stay set in the masks, so repeated full resets exhaust the index space.
Clear validlinks in the reset vif iterator and reset the MLD index masks alongside the existing omacmask clearing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
In the reset vif iterator, clear mvif->valid_links and reset the per-link and per-vif group/remap MLD index masks alongside the existing omac_mask clearing.
Linux kernel mt76 mt7996 full-chip reset path valid_links and MLD index masks = clear valid_links and reset per-link and per-vif group/remap MLD index masks
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Linux kernel systems using the mt76 mt7996 Wi-Fi driver when the device undergoes a full chip reset. It is specific to the mt7996 reset and mac80211 reconfiguration path, not to all Linux Wi-Fi devices.
What is the operational impact after a full reset?
Reconfiguration can fail to recreate firmware device, BSS, and station records or re-register the link WCID. This can leave the Wi-Fi device inoperative after the reset.
Why are repeated full resets particularly problematic?
The reset path can leave previously allocated MLD index bits marked as in use while reconfiguration allocates new indices. Repeated full resets can therefore exhaust the available MLD index space.