CVE-2026-90366: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
When a CSA countdown is active, mt7996mcubeaconcntdwn() emits two bssbcncntdwntlv entries (the CSA countdown and the CCA-abort BCC), but MT7996BEACONUPDATESIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996MAXBSSOFFLOADSIZE and trigger skboverpanic(). Reserve room for both countdown TLVs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to the overflow condition?
The condition requires an mt7996 device using MBSSID, an active CSA countdown, and a beacon template close to the maximum supported size. The extra countdown TLV can then make the beacon offload command exceed MT7996_MAX_BSS_OFFLOAD_SIZE.
What is the operational impact if the condition is triggered?
The oversized offload command can trigger skb_over_panic(). This can cause a kernel panic.
How can I determine whether this condition may already affect a system?
Review whether the system uses mt7996 with MBSSID enabled and performs channel switch announcements while using near-maximum beacon templates. Kernel logs or crash reports containing skb_over_panic() during beacon offload updates are consistent with the described failure.
What should be done if an update cannot be applied immediately?
Avoid the combination of MBSSID, active CSA countdowns, and near-maximum beacon templates where possible. The resolved change reserves space for both countdown TLVs in the beacon update buffer.