CVE-2026-90374: wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: validate RX bandidx before dereferencing phys[]
bandidx comes from a 2-bit descriptor field (0-3) and was used directly to index dev->mt76.phys[] (size MTMAXBAND == 3) and dereference the result. A corrupt or reserved descriptor value could index out of bounds or hit a NULL phy on parts with fewer bands. Reject invalid band indices, mirroring mt7996rxgetwcid().
Event History
Frequently Asked Questions
Which deployments are exposed to this condition?
Linux systems using the mt76 mt7996 Wi-Fi driver are in scope. Devices with fewer supported bands are particularly affected because an otherwise in-range array slot can contain a NULL PHY pointer.
What condition is required to trigger the unsafe access?
The receive descriptor must contain a corrupt or reserved 2-bit band index. The vulnerable code used that value directly, allowing an out-of-bounds phys[] access for index 3 or a NULL PHY dereference on hardware with fewer bands.