UBUNTU-CVE-2026-90349: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx() When mac80211 leaves the link unspecified, mt7996tx() substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->linkconf[], mvif->mt76.link[] and sta->link[], all of which hold IEEE80211MLDMAXNUMLINKS (15) entries. Clamp the primary link id to the default link before using it, and use the clamped value for the linksta fallback as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mt7996_tx(), clamp the primary link id to the default link before using it, and use the clamped value for the link_sta fallback to prevent out-of-bounds access to vif->link_conf[], mvif->mt76.link[], and sta->link[].
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using one of the listed Ubuntu Linux kernel packages may be affected when they use the mt76 mt7996 Wi-Fi driver. The out-of-bounds access is in the transmit path when mac80211 leaves the link unspecified before a station or virtual interface has had its first link added.
What condition triggers the out-of-bounds access?
The driver substitutes a station or virtual interface primary link ID when the link is unspecified. Before the first link is added, that ID can be IEEE80211_LINK_UNSPECIFIED (0xf), which is used to index arrays containing only 15 entries unless it is clamped to the default link.
What does the fix change?
The fix clamps the primary link ID to the default link before using it to access the virtual-interface and station link arrays. It also uses the clamped value for the link_sta fallback.