CVE-2026-90370: wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig
The response TLV loop advanced by tlv->len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during device probe. The u32 payload was also read without bounds checking. Reject a short fixed field, stop on a TLV whose length underruns the header or overruns the skb.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the hang?
The issue requires an mt7996 device to receive a malformed firmware response while mt7996_mcu_get_chip_config is processing chip configuration during device probe. A zero-length TLV could cause the response-processing loop not to advance, hanging the CPU.
What malformed response fields are relevant?
A TLV with a length smaller than its header, a length that extends beyond the skb, or a response too short for the expected fixed u32 field is malformed. The resolved code rejects these conditions rather than continuing to parse the response.
How can this affect a system operationally?
The described impact is a CPU hang during device probe, which can prevent successful initialization of the affected wireless device. The provided information does not describe data exposure, privilege escalation, or remote network-triggered exploitation.