CVE-2026-90380: wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete
A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the STA.
Set the links' wcid pointers to be NULL for a MLD in mt7925staprercuremove()
BUG: KASAN: invalid-access in mt76rxpollcomplete+0x280/0x470 Call trace: dumpbacktrace+0xec/0x128 showstack+0x18/0x28 dumpstacklvl+0x40/0xc8 printreport+0x1b8/0x710 kasanreport+0xe0/0x144 dobadarea+0x120/0x260 dotagcheckfault+0x20/0x34 domemabort+0x54/0xa8 el1abort+0x3c/0x5c el1h64synchandler+0x40/0xcc el1h64sync+0x7c/0x80 mt76rxpollcomplete+0x280/0x470 mt76dmarxpoll+0x114/0x51c mt792xpollrx+0x60/0xf8 napithreadedpollloop+0xe0/0x450 napithreadedpoll+0x80/0x9c kthread+0x11c/0x158 retfromfork+0x10/0x20
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix described: in mt76_rx_poll_complete, set the links' wcid pointers to be NULL for a MLD in the STA removal/race condition, so that after mt7925_sta_pre_rcu_remove() removes the STA, rx_status does not dereference a stale wcid pointer.
Linux kernel (mt76/mt792x) mt76_rx_poll_complete: links' wcid pointers for an MLD = set to NULL
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel's mt76 mt792x Wi-Fi receive path are implicated. The race occurs when a station has been removed while receive status still retains a pointer to that station's WCID, including link WCID pointers for an MLD.
What runtime condition triggers the issue?
The condition requires a race between station removal and RX polling/completion. mt76_rx_poll_complete can then dereference a WCID pointer associated with a station that has already been removed.
How can I identify whether this has occurred?
A KASAN report may identify an invalid access in mt76_rx_poll_complete. The reported receive-path call chain can include mt76_dma_rx_poll, mt792x_poll_rx, and napi_threaded_poll.
What can be done if the affected code is present?
Apply a kernel update containing the referenced stable fixes. The fix clears link WCID pointers for an MLD during mt7925_sta_pre_rcu_remove(), preventing stale RX status pointers from referencing a removed station.