CVE-2026-90378: wifi: mt76: mt792x: Fix memory leak in SDIO TX path
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt792x: Fix memory leak in SDIO TX path
When txprepareskb() returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames (such as WNM NULL frames) are dropped to prevent potential hardware TX hangs.
Fix this by properly releasing the skb with ieee80211txstatusext() when txprepareskb() fails.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this leak?
The issue is in the Linux kernel mt76 mt792x Wi-Fi driver's SDIO transmit path. Exposure requires use of that driver and its SDIO TX path.
What traffic condition triggers the problem?
The leak occurs when tx_prepare_skb() returns an error and the associated skb is not released. The description identifies dropped zero-length frames, including WNM NULL frames, as a condition that can cause this error path.
What should be done if the affected path is encountered?
Apply a kernel version containing the fix referenced in the provided stable kernel commits. The fix releases the skb through ieee80211_tx_status_ext() when tx_prepare_skb() fails.