CVE-2026-90373

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915_remove_interface() cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the allocators, which all run under dev->mt76.mutex; on DBDC the two wiphys share one mt76_dev, so this raced add_interface/sta_add on the other band and could leak or double-hand-out a wcid. Clearing the bit before the RCU pointer also let a concurrent allocation reuse the index and publish its wcid, which the subsequent NULL assignment then wiped. Move the clear into the existing mutex section, after the RCU pointer is cleared.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:36.503000

Last modified

2026-10-30 13:20:51.537000

View original CVE JSON

{
  "id": "CVE-2026-90373",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:36.503",
  "lastModified": "2026-10-30T13:20:51.537",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear\n\nmt7915_remove_interface() cleared the wcid mask bit with no lock held and\nbefore clearing the RCU wcid pointer. The mask is a non-atomic RMW shared\nwith the allocators, which all run under dev->mt76.mutex; on DBDC the two\nwiphys share one mt76_dev, so this raced add_interface/sta_add on the\nother band and could leak or double-hand-out a wcid. Clearing the bit\nbefore the RCU pointer also let a concurrent allocation reuse the index\nand publish its wcid, which the subsequent NULL assignment then wiped.\nMove the clear into the existing mutex section, after the RCU pointer is\ncleared."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "lessThan": "5dce25f1d609ba991a9c22c27be586c92f03ed77",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "lessThan": "b4a41a47a67c788e6b0625fa517ec8872e99bb6c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "lessThan": "a97b2b942d2f8f12fbd6a7caafc735d1ad115e6b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
              "lessThan": "6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b7c8e22dfddacc1b08dbf44f5be2c66305d757bc",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a582b1d54313dcdc96e7d8e1f49495dd71ddaf3e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.1.191",
              "lessThan": "6.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.6.160",
              "lessThan": "6.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/5dce25f1d609ba991a9c22c27be586c92f03ed77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a97b2b942d2f8f12fbd6a7caafc735d1ad115e6b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b4a41a47a67c788e6b0625fa517ec8872e99bb6c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}