CVE-2026-90365: wifi: mt76: cancel reset and rc work on device unregister
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: cancel reset and rc work on device unregister
Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue() in mt76freedevice(), which runs after the hw is unregistered and the hardware stopped. A resetwork that fires in that window calls ieee80211restarthw() and re-arms macwork on an unregistered hw, and rcwork touches station state being torn down. Cancel both up front, alongside dumpwork.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It can occur during device unregister, if mt76 reset_work or rc_work remains pending after the hardware has been unregistered and stopped. A reset work item may restart the hardware and re-arm mac_work on an unregistered device, while rc_work can access station state during teardown.
Which systems are exposed?
Systems using the Linux kernel mt76 Wi-Fi drivers are relevant, specifically where a device can be unregistered while reset_work or rc_work is pending. The provided information does not identify affected kernel versions or specific mt76 hardware models.
What is the mitigation if an update cannot be applied immediately?
The provided fix cancels reset_work and rc_work during device unregister, alongside dump_work. No alternative configuration workaround or operational mitigation is provided.