CVE-2026-90389

CVE-2026-90389 is a bug in the Linux kernel md (multiple device) subsystem . The root cause is that a memalloc_noio_save() token is stored in mddev->noio_flags, allowing one task to save the token and another task to restore it . With concurrent sysfs writes to suspend_lo and suspend_hi, task ...

CVE-2026-90389 md: scope memalloc_noio to allocation critical sections

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90380 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the...

CVE-2026-90380

CVE-2026-90380 is a use-after-free in the Linux kernel's mt76 WiFi driver (mt792x variant), occurring in mt76_rx_poll_complete due to a race condition: a station (STA) is removed but rx_status still holds a pointer to the freed wcid. The fix sets the links' wcid pointers to NULL in mt7925_sta_pre...

EUVD-2026-82041

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the...

CVE-2026-90380 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the...

EUVD-2026-82034

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90373

A race condition in the Linux kernel mt76 mt7915 WiFi driver allowed mt7915_remove_interface() to clear the wcid mask bit without holding the mutex and before clearing the RCU wcid pointer. On DBDC (dual-band dual-concurrent) configurations, the two wiphys share one mt76_dev, so this raced with a...

CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90371 wifi: mt76: fix RXDMAD_C buffer recycling race

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

EUVD-2026-82032

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

EUVD-2026-82028

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90367 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90367 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90367

CVE-2026-90367 is a race condition in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7996 hardware. The root cause is that mt7996_mac_reset_work() parked the TX worker and disabled RX/TX NAPIs before taking dev->mt76.mutex, while __mt76_set_channel() toggles the same worker ...

CVE-2026-90365 wifi: mt76: cancel reset and rc work on device unregister

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

CVE-2026-90365

CVE-2026-90365 affects the mt76 WiFi driver in the Linux kernel. The root cause is a workqueue ordering flaw: both mt76 drivers cancelled dump_work on device unregister but left reset_work and rc_work to be flushed only later by destroy_workqueue() in mt76_free_device(), which runs after the hard...

EUVD-2026-82026

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

CVE-2026-90360 regulator: core: use system_freezable_wq for init complete work

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...