CVE-2026-90377: wifi: mt76: fix RX data queuing of RRO 3.0

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: fix RX data queuing of RRO 3.0

For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only polls skbs queued on the MTRXQRROIND list; frames queued under the data queue id are left sitting on that list until the data queue NAPI happens to run, stalling and reordering RX data.

Event History

Sep 17, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Systems using the Linux kernel mt76 Wi-Fi driver with RRO 3.0 are affected. The issue concerns receive-path handling for RRO data queues.

2

What is the operational impact?

Received frames can remain queued under a data queue ID until that queue's NAPI poll runs. This can stall RX processing and cause received data to be reordered.

3

How can I tell whether the problem is occurring?

The described symptom is RX data stalling or arriving out of order when using RRO 3.0. The affected frames are left on a data-queue list instead of being processed by the indicator-queue NAPI context.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203