Linux Distros Unpatched Vulnerability : CVE-2026-90374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys...

Linux Distros Unpatched Vulnerability : CVE-2026-90356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset mt7996macresetvifiter queues non-default vif links for kfreercu while dev-wcid stil...

Linux Distros Unpatched Vulnerability : CVE-2026-90366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CS...

Linux Distros Unpatched Vulnerability : CVE-2026-90376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error...

Linux Distros Unpatched Vulnerability : CVE-2026-90367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking...

Linux Distros Unpatched Vulnerability : CVE-2026-90370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response...

Linux Distros Unpatched Vulnerability : CVE-2026-90355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup...

Linux Distros Unpatched Vulnerability : CVE-2026-90351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached...

DEBIAN-CVE-2026-90370

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

AZL-102785 CVE-2026-90374 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90376

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

DEBIAN-CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

DEBIAN-CVE-2026-90376

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90370

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

AZL-102938 CVE-2026-90370 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

AZL-102164 CVE-2026-90367 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90366

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

DEBIAN-CVE-2026-90367

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

AZL-102923 CVE-2026-90366 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...