CVE-2026-90377: wifi: mt76: fix RX data queuing of RRO 3.0
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix RX data queuing of RRO 3.0
For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only polls skbs queued on the MTRXQRROIND list; frames queued under the data queue id are left sitting on that list until the data queue NAPI happens to run, stalling and reordering RX data.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel mt76 Wi-Fi driver with RRO 3.0 are affected. The issue concerns receive-path handling for RRO data queues.
What is the operational impact?
Received frames can remain queued under a data queue ID until that queue's NAPI poll runs. This can stall RX processing and cause received data to be reordered.
How can I tell whether the problem is occurring?
The described symptom is RX data stalling or arriving out of order when using RRO 3.0. The affected frames are left on a data-queue list instead of being processed by the indicator-queue NAPI context.