CVE-2026-90357: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
The flow is added to dev->twtlist before sending the agreement to the firmware, but the error path leaves it linked while flowidmask is never set. The flow slot can then be reused and memset while still on the list, corrupting twtlist, and station removal leaves a dangling entry behind that mt7915mactwtschedlistadd() later walks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are implicated by this issue?
The issue affects Linux kernel deployments using the mt76 mt7915 Wi-Fi driver path that creates TWT agreements. It is triggered when the firmware MCU rejects an agreement after the flow has been added to the device TWT list.
What condition leads to list corruption?
A rejected agreement leaves the flow linked in dev->twt_list without setting flowid_mask. The same flow slot can later be reused and cleared while it remains linked, corrupting the list.
How can the problem persist after a station is removed?
Station removal can leave a dangling TWT-list entry. A later call to mt7915_mac_twt_sched_list_add() may walk that dangling entry.
What should be done to remediate the issue?
Update to a Linux kernel version that includes the referenced stable fixes. The correction unlinks the TWT flow when the MCU rejects the agreement.