UBUNTU-CVE-2026-90369: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy() and mt76mmioreadcopy() iterate up to ALIGN(len, 4), so a length that is not a multiple of four reads past the source buffer (writecopy) or writes past the destination (readcopy). Copy the aligned body in the loop and handle the remaining tail through a 4-byte bounce buffer, keeping the register access width unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update mt76_mmio_write_copy() and mt76_mmio_read_copy() to copy the aligned body in the loop and handle the remaining tail through a 4-byte bounce buffer, keeping the register access width unchanged.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected Ubuntu kernel package variants listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The issue is in the mt76 Wi-Fi driver MMIO copy helpers.
What condition triggers the out-of-bounds access?
A caller must use mt76_mmio_write_copy() or mt76_mmio_read_copy() with a copy length that is not divisible by four. The helpers iterate through the length rounded up to a four-byte boundary, causing a read beyond the source buffer or a write beyond the destination buffer.
What is the impact of each affected helper?
mt76_mmio_write_copy() can read beyond the supplied source buffer. mt76_mmio_read_copy() can write beyond the supplied destination buffer.