CVE-2026-90368: wifi: mt76: mt7915: unwind state on add_interface failure
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: unwind state on addinterface failure
When mt76wcidalloc() fails, mt7915addinterface() returned without clearing the vifmask/omacmask bits it had already set, without removing the firmware dev info added earlier, and without clearing a monitorvif pointer to the vif mac80211 is about to free. mac80211 does not call removeinterface() for a failed add, so the indices and firmware dev entry leaked permanently and testmode could dereference the stale monitorvif. Add a proper error unwind.
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
It occurs when mt76_wcid_alloc() fails during mt7915_add_interface(). Because mac80211 does not call remove_interface() after a failed interface addition, previously created state is not cleaned up.
What is the practical impact of a failed interface addition?
The failure can permanently leak vif_mask and omac_mask indices and a firmware device-info entry. It can also leave monitor_vif pointing to an interface that mac80211 is about to free, allowing testmode to dereference a stale pointer.
What should teams do if they cannot immediately apply the fix?
The provided data does not describe a workaround. Reduce exposure to failed interface-addition paths and avoid testmode operations after such failures where operationally possible.