CVE-2026-90371: wifi: mt76: fix RXDMAD_C buffer recycling race
Published Sep 17, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix RXDMADC buffer recycling race
The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the non-direct path as is already done for WED RX queues.
Event History
Sep 17, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description
Frequently Asked Questions
1
Is a fix available?
Yes. The issue is marked resolved, with fixes referenced by three Linux stable-tree commits: 7ac05ed3a50e511c93f8506e555709a208dfce0a, a273dc3b86a7d983d643827d3d3c795d55d8f632, and e1f97c10a4ec2b9db69a134b757304399ca903ce.
2
What does the fix change?
The fix avoids directly recycling RXDMAD_C buffers through a page pool owned by a different NAPI context. It instead uses the non-direct recycling path already used for WED RX queues.