CVE-2026-90366: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
When a CSA countdown is active, mt7996mcubeaconcntdwn() emits two bssbcncntdwntlv entries (the CSA countdown and the CCA-abort BCC), but MT7996BEACONUPDATESIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996MAXBSSOFFLOADSIZE and trigger skboverpanic(). Reserve room for both countdown TLVs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to the overflow condition?
The condition requires an mt7996 device using MBSSID, an active CSA countdown, and a beacon template close to the maximum supported size. The extra countdown TLV can then make the beacon offload command exceed MT7996_MAX_BSS_OFFLOAD_SIZE.
What is the operational impact if the condition is triggered?
The oversized offload command can trigger skb_over_panic(). This can cause a kernel panic.
How can I determine whether this condition may already affect a system?
Review whether the system uses mt7996 with MBSSID enabled and performs channel switch announcements while using near-maximum beacon templates. Kernel logs or crash reports containing skb_over_panic() during beacon offload updates are consistent with the described failure.
What should be done if an update cannot be applied immediately?
Avoid the combination of MBSSID, active CSA countdowns, and near-maximum beacon templates where possible. The resolved change reserves space for both countdown TLVs in the beacon update buffer.