CVE-2026-90372: wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss
If a peer's VHT/HE MCS map has no supported spatial stream (all fields 0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255), which was then written into the firmware starecbf beamforming fields. Clamp the result to 0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the mt7915 implementation so mt7915_mcu_get_sta_nss clamps the NSS result to 0 to prevent an underflow scenario that would otherwise yield (u8)-1 (255) and be written into the firmware sta_rec_bf beamforming fields.
Linux kernel wifi: mt76 (mt7915) Avoid nss underflow in mt7915_mcu_get_sta_nss (clamp sta_rec_bf beamforming nss result to 0) = Clamp result to 0 when nss==0 and function would return (u8)-1/255; ensure VHT/HE MCS map with no supported spatial stream results in nss=0
Event History
Frequently Asked Questions
What condition triggers the incorrect value?
The issue occurs when a peer's VHT/HE MCS map reports no supported spatial streams, with all fields set to 0x3. In that case, the NSS calculation reaches zero and previously converted it to the unsigned value 255.
What component receives the incorrect NSS value?
The value is written into the firmware sta_rec_bf beamforming fields. The resolved behavior clamps the NSS result to 0 instead of allowing the zero value to underflow to 255.