CVE-2026-90367: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
mt7996macresetwork() parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. mt76workerdisable()/enable() are plain kthread park/unpark, not refcounted, and mt76setchannel() toggles the same worker and the MT76RESET bit under the mutex. An L1 SER racing a channel switch could therefore have the worker unparked and MT76RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens. Take the mutex before disabling the worker, as mt7915 does.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
An L1 SER event must race with a channel switch. In that race, the TX worker can be unparked and the MT76_RESET bit cleared while the reset path is resetting DMA rings.
What is the practical impact of the race?
The concurrent reset and worker activity can corrupt DMA descriptors or tokens.
What does the resolved change do?
The reset path now takes dev->mt76.mutex before disabling the TX worker. This serializes worker and reset-state changes with channel switching.