CVE-2026-90381: wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx()
When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each struct ieee80211vifchanctxswitch.
Rework mt76switchvifchanctx() to properly handle this scenario.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The issue requires channel switches on different radios to occur within a short timeframe, with channel contexts for different bands carried in the switch operation.
Which systems are exposed?
Systems using the Linux kernel mt76 Wi-Fi driver may be exposed when they use multiple radios and perform closely timed channel switches across different bands.
How can I determine whether my system has the fix?
Check whether your kernel includes either of the referenced stable commits: 063169a2755abdcbe7698d98360336abb6bef414 or 70869cc429fffc77de51e7777c0ecb651e8fca07.