CVE-2026-90373: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
mt7915removeinterface() cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the allocators, which all run under dev->mt76.mutex; on DBDC the two wiphys share one mt76dev, so this raced addinterface/staadd on the other band and could leak or double-hand-out a wcid. Clearing the bit before the RCU pointer also let a concurrent allocation reuse the index and publish its wcid, which the subsequent NULL assignment then wiped. Move the clear into the existing mutex section, after the RCU pointer is cleared.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel mt76 mt7915 Wi-Fi driver are affected when interfaces or stations are added or removed concurrently. The described race is specifically relevant to DBDC operation, where two wiphys share one mt76_dev.
What conditions are needed to trigger the issue?
An interface removal must race with add_interface or sta_add activity on the other band. The shared WCID allocation mask is modified without the mutex, allowing an allocator to observe and reuse an index at the wrong time.
What can happen if the race is triggered?
A WCID can be leaked or handed out twice. A concurrent allocation can also publish a WCID pointer that is subsequently cleared by the interface-removal path.
What is the relevant remediation?
Use a kernel version containing the fix that clears the RCU WCID pointer first and then clears the WCID mask while holding dev->mt76.mutex. The listed stable-kernel references identify commits carrying that change.