CVE-2026-90367
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER mt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex. An L1 SER racing a channel switch could therefore have the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens. Take the mutex before disabling the worker, as mt7915 does.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 27015b6fbcca836c6dbf196afc266e068af4aeec | affected | git | bc4f4389f439e808185778d298da36976d13d415 | Unavailable | None listed |
| 27015b6fbcca836c6dbf196afc266e068af4aeec | affected | git | 69f23622533a4f054b5c8fdb226c3319ffa017b6 | Unavailable | None listed |
| 27015b6fbcca836c6dbf196afc266e068af4aeec | affected | git | 906ad486ba5c4933d82e1ebe0685656390a48450 | Unavailable | None listed |
| 27015b6fbcca836c6dbf196afc266e068af4aeec | affected | git | 594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701 | Unavailable | None listed |
| 27015b6fbcca836c6dbf196afc266e068af4aeec | affected | git | 6190db312b8230813f529f014b26247c6d9800d0 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.4 | Unavailable | None listed |
| 6.6.160 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.114 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.52 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.6 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |