CVE-2026-90368: wifi: mt76: mt7915: unwind state on add_interface failure
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: unwind state on addinterface failure
When mt76wcidalloc() fails, mt7915addinterface() returned without clearing the vifmask/omacmask bits it had already set, without removing the firmware dev info added earlier, and without clearing a monitorvif pointer to the vif mac80211 is about to free. mac80211 does not call removeinterface() for a failed add, so the indices and firmware dev entry leaked permanently and testmode could dereference the stale monitorvif. Add a proper error unwind.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
It occurs when mt76_wcid_alloc() fails during mt7915_add_interface(). Because mac80211 does not call remove_interface() after a failed interface addition, previously created state is not cleaned up.
What is the practical impact of a failed interface addition?
The failure can permanently leak vif_mask and omac_mask indices and a firmware device-info entry. It can also leave monitor_vif pointing to an interface that mac80211 is about to free, allowing testmode to dereference a stale pointer.
What should teams do if they cannot immediately apply the fix?
The provided data does not describe a workaround. Reduce exposure to failed interface-addition paths and avoid testmode operations after such failures where operationally possible.