CVE-2026-90374

CVE-2026-90374 affects the mt76 mt7996 Wi-Fi driver in the Linux kernel. The root cause is an out-of-bounds array access : the band_idx value, sourced from a 2-bit descriptor field (range 0–3), was used to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) without validation. A corrupt or reserv...

EUVD-2026-82035

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90374 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...