CVE-2026-90375: wifi: mt76: fix non-AQL packet accounting for MLO stations
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix non-AQL packet accounting for MLO stations
mt76txqueueskb() overrides the wcid passed by the driver with sta->drvpriv, so the wcid might incorrectly be changed after TX, causing wcid->nonaqlpackets to be counted on the wrong wcid. For example, on the AP side, if a station's setup link is the 5G link and the station uses 2G to transmit a frame, the value of nonaqlpackets is increased on the 5G wcid but decreased on the 2G wcid. Once the inflated counter exceeds MTMAXNONAQLPKT, the TX scheduler permanently refuses to service the station.
Drop the reassignment and account on the wcid used for transmission. This also records the actual wcid in the queue entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which deployments are exposed to the service impact?
The issue applies to Linux kernel systems using the mt76 Wi-Fi driver with MLO stations. The described failure occurs on the AP side when a station's setup link differs from the link used to transmit a frame, such as a 5 GHz setup link and 2.4 GHz transmission.
What conditions lead to transmission being denied for a station?
Traffic must cause non-AQL packet accounting to be credited to the wrong WCID. If the incorrectly inflated counter exceeds MT_MAX_NON_AQL_PKT, the TX scheduler permanently refuses to service that station.
How can an administrator recognize the affected behavior?
A station may stop being serviced by the TX scheduler after its non-AQL packet counter is inflated on a different WCID than the one used for transmission. The example pattern is an increase on the 5 GHz WCID while the corresponding decrease occurs on the 2.4 GHz WCID.