CVE-2026-90376

A flaw was found in the MediaTek mt76 Wi-Fi driver within the Linux kernel. An incorrect Multi-Link Device MLD ID in the MAC Transmit Descriptor TXD and Host Interface Transmit Packet HIF TXP can cause the firmware to enter a busy loop. This issue occurs when a third MLD link is in power saving...

CVE-2026-90375

A flaw was found in the Wi-Fi mt76 driver of the Linux kernel. This vulnerability arises from incorrect accounting of non-AQL Atheros Quality of Service packets for Multi-Link Operation MLO stations. Specifically, the mt76txqueueskb function can misattribute packet counts, leading to an inflated...

CVE-2026-90374

A flaw was found in the Linux kernel's mt76 wifi driver. This vulnerability occurs due to improper validation of the bandidx field, which is used to index an array. A malicious actor could provide a corrupt or reserved descriptor value, leading to an out-of-bounds access or a NULL pointer...

CVE-2026-90373

A flaw was found in the Linux kernel's mt76 wireless driver, specifically within the mt7915 module. The mt7915removeinterface function cleared a Wireless Client ID wcid mask bit without proper locking mechanisms and before clearing the associated RCU Read-Copy-Update pointer. This oversight creat...

CVE-2026-90372

A flaw was found in the Linux kernel's mt76 WiFi driver, affecting mt7915 devices. A remote attacker, by sending a specially crafted VHT/HE MCS map with no supported spatial streams, can trigger an integer underflow in the mt7915mcugetstanss function. This results in an incorrect value being...

CVE-2026-90371

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability is a race condition that occurs during the recycling of RXDMADC buffers. These buffers are associated with different Network Adapter Programming Interface NAPI instances, and a direct recycling method can lead to a timin...

CVE-2026-90370

A flaw was found in the kernel. Specifically, within the mt76 Wi-Fi driver's mt7996mcugetchipconfig function, a malformed firmware response containing a zero-length Type-Length-Value TLV could cause an infinite loop. This issue occurs during device initialization and can lead to a system hang,...

CVE-2019-2215

CVE-2019-2215 Exploit for the Bad Binder vulnerability in Android written by @wired0ut. It abuses the UAF in order to leak taskstruct, then overwrites addrlimit and escalates privileges by overwriting the id block in cred. The full flow of the research and exploitation can be found here series of...

CVE-2026-90369

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. The mt76mmiowritecopy and mt76mmioreadcopy functions, which handle memory-mapped I/O MMIO operations, can perform out-of-bounds reads or writes. This occurs when the data length is not a multiple of four, leading to memory access beyond th...

CVE-2026-90368

A flaw was found in the Wi-Fi driver mt76: mt7915 of the Linux kernel. Improper error handling during the addition of a new Wi-Fi interface can lead to the permanent leakage of system resources and a stale pointer dereference. This vulnerability could allow a local attacker to cause system...

CVE-2026-90367

A flaw was found in the Linux kernel's mt7996 Wi-Fi driver. The driver fails to properly hold a mutex, which is a mechanism to prevent simultaneous access to shared resources, when disabling a transmit worker during System Error Recovery SER. This oversight creates a race condition where a...

CVE-2026-90366

A flaw was found in the Linux kernel's mt76 Wi-Fi driver, specifically affecting mt7996 devices. When a Channel Switch Announcement CSA countdown is active and Multiple Basic Service Set Identifier MBSSID is enabled, the driver may attempt to write more beacon data than allocated. This can lead t...

CVE-2026-90365

A flaw was found in the mt76 Wi-Fi driver in the Linux kernel. During device unregistration, certain work items resetwork and rcwork were not properly cancelled. This oversight could allow these work items to execute on an unregistered hardware, potentially leading to unexpected behavior, resourc...

CVE-2026-90363

A flaw was found in the Linux kernel's drm/msm component. During the initialization of Kernel Mode Setting KMS, an error handling path attempts to deallocate resources twice. This double deallocation leads to a use-after-free error, which can cause a system crash. A local attacker could potential...

CVE-2026-90359

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When BPF programs are attached to functions that return 16-byte values using specific trampoline types such as fexit, fmodret, fsession, or structops, the BPF trampoline incorrectly preserves only 8 bytes of the return...

CVE-2026-90358

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter x86 trampoline. When processing 128-bit arguments, the system incorrectly calculates the required stack size for saving registers. This under-allocation leads to memory corruption by overwriting adjacent stack slots. A local attack...

CVE-2026-90357

A flaw was found in the Linux kernel's Wi-Fi subsystem, specifically within the mt76: mt7915 driver. This vulnerability occurs when a Target Wake Time TWT flow is added to an internal list but not correctly unlinked if the firmware rejects the agreement. This improper handling can lead to the reu...

CVE-2026-90356

A flaw was found in the Linux kernel's mt76 wifi driver, specifically in the mt7996 component. This vulnerability arises from an incorrect order of operations during a full reset, where Virtual Interface VIF links are freed before their corresponding Wireless Client ID WCID entries are cleared...

CVE-2026-90353

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability arises from a use-after-free error in the external PHY physical layer registration error path. When the main PHY initialization fails after the external PHY has been registered, the external PHY hardware is prematurely...

CVE-2026-90351

A flaw was found in the Linux kernel's mt76 mt7996 Wi-Fi driver. When the primary PCIe function's Wireless Ethernet Dispatch WED attachment fails, the system incorrectly proceeds to attach the secondary function's WED. This leaves the device in an inconsistent state, which can lead to a system...