CVE-2026-90380

CVE-2026-90380 is a use-after-free in the Linux kernel's mt76 WiFi driver (mt792x variant), occurring in mt76_rx_poll_complete due to a race condition: a station (STA) is removed but rx_status still holds a pointer to the freed wcid. The fix sets the links' wcid pointers to NULL in mt7925_sta_pre...

EUVD-2026-82038

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only...

CVE-2026-90377

CVE-2026-90377 affects the mt76 WiFi driver in the Linux kernel, specifically the RRO 3.0 RX data queuing path. The root cause is that RX frames released from a RRO data queue were placed on the data queue list instead of the MT_RXQ_RRO_IND indicator queue list. Because the indicator queue NAPI o...

CVE-2026-90377 wifi: mt76: fix RX data queuing of RRO 3.0

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only...

CVE-2026-90377 wifi: mt76: fix RX data queuing of RRO 3.0

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only...

CVE-2026-90376

This vulnerability affects the Linux kernel 's mt76:mt7996 WiFi driver. When the MLD_ID field in a TXD is neither the primary nor secondary link ID, it can trigger a firmware busy loop if the third link is in power saving mode, resulting in MCU command timeouts and repeated firmware error logs ("...

EUVD-2026-82037

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

CVE-2026-90376 wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

CVE-2026-90375 wifi: mt76: fix non-AQL packet accounting for MLO stations

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90375

CVE-2026-90375 affects the mt76 Wi-Fi driver in the Linux kernel. The root cause is in __mt76_tx_queue_skb(), which overrides the wcid passed by the driver with sta->drv_priv. For MLO (Multi-Link Operation) stations, this causes non_aql_packets to be counted on the wrong wcid — for example, a ...

EUVD-2026-82036

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90375 wifi: mt76: fix non-AQL packet accounting for MLO stations

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90372

CVE-2026-90372 affects the Linux kernel mt76 Wi-Fi driver, specifically the mt7915 subsystem. In mt7915_mcu_get_sta_nss, if a peer's VHT/HE MCS map has no supported spatial streams (all fields 0x3), the loop exits with nss == 0 and the function returns (u8)-1 (255), which is then written into fir...

CVE-2026-90371 wifi: mt76: fix RXDMAD_C buffer recycling race

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

CVE-2026-90371 wifi: mt76: fix RXDMAD_C buffer recycling race

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

EUVD-2026-82032

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

CVE-2026-90371

CVE-2026-90371 affects the mt76 WiFi driver in the Linux kernel. The root cause is a race condition in RXDMAD_C buffer recycling: these buffers originate from RRO data queues' page pools, which are bound to a different NAPI context. The direct page-pool recycle path could race with the owning NAP...

CVE-2026-90369

This Linux kernel vulnerability affects the mt76 Wi-Fi driver's MMIO copy helpers. The functions mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to ALIGN(len, 4), causing an out-of-bounds access when the length is not a multiple of four: write_copy reads past the source buffer and rea...

EUVD-2026-82030

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...

CVE-2026-90369 wifi: mt76: fix out-of-bounds access in mmio copy helpers

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...