CVE-2026-90351 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

EUVD-2026-82012

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90350

CVE-2026-90350 affects the mt76 WiFi driver in the Linux kernel (mt7996 variant). The function mt76_vif_link() indexes the mvif->link[] array without validating link_id. Callers pass deflink_id, which holds IEEE80211_LINK_UNSPECIFIED (0xf) until the first link is added. Since IEEE80211_MLD_MAX...

CVE-2026-90351

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90350 wifi: mt76: reject out-of-range link ids in mt76_vif_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

EUVD-2026-82010

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90349

CVE-2026-90349 is an out-of-bounds array access in the Linux kernel's mt76 mt7996 Wi-Fi driver. In mt7996_tx() , when mac80211 leaves the link unspecified, the primary link id is IEEE80211_LINK_UNSPECIFIED (0xf) —a value of 15—yet it is used unchecked to index vif->link_conf[] , mvif->mt76....

CVE-2026-90349

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90347

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90347 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90347 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90347

CVE-2026-90347 is a flaw in the Linux kernel on arm64 architectures, in the ptrace subsystem's handling of the orig_x0 register. A prior fix (commit e057b9477232) intended to prevent a tracer from manipulating the first syscall argument (x0) without seccomp or audit scrutiny was incomplete: it fa...

EUVD-2026-82008

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90348

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90346 wifi: nl80211: clean up color-change beacon data on errors

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

EUVD-2026-82007

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

CVE-2026-90346

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

CVE-2026-90346

This Linux kernel vulnerability affects the nl80211 WiFi subsystem. The root cause is a memory leak in nl80211_color_change(): when nl80211_parse_beacon() fails while parsing the beacon_next template, it returned directly without releasing previously allocated mbssid_ies and rnr_ies buffers via t...