CVE-2026-90356: wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
mt7996macresetvifiter() queues non-default vif links for kfreercu while dev->wcid[] still holds pointers to the wcid embedded in each freed link; mt76resetdevice() then dereferences those entries and runs mt76wcidcleanup() on them. If a grace period elapses in between, the cleanup operates on freed memory.
Run mt76resetdevice() first, so the wcid entries are cleaned up and cleared while the links are still valid.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mt76 mt7996 Wi-Fi driver are exposed when the affected reset path handles non-default virtual-interface links. The issue involves full device reset processing and stale wcid pointers associated with those links.
What condition triggers the use-after-free?
A full reset must queue non-default vif links for deferred freeing while dev->wcid[] still points to the embedded wcid objects. If an RCU grace period elapses before mt76_reset_device() cleans those entries, cleanup can dereference freed memory.
How is the issue fixed?
The reset ordering is changed so mt76_reset_device() runs before the vif links are freed. This cleans up and clears the wcid entries while the corresponding links are still valid.