CVE-2026-90369

This Linux kernel vulnerability affects the mt76 Wi-Fi driver's MMIO copy helpers. The functions mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to ALIGN(len, 4), causing an out-of-bounds access when the length is not a multiple of four: write_copy reads past the source buffer and rea...

CVE-2026-90368

CVE-2026-90368 affects the Linux kernel 's mt76/mt7915 WiFi driver. When mt76_wcid_alloc() fails inside mt7915_add_interface() , the function returned without clearing the vif_mask/omac_mask bits it had already set, without removing the firmware dev info added earlier, and without clearing the mo...

CVE-2026-90367

CVE-2026-90367 is a race condition in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7996 hardware. The root cause is that mt7996_mac_reset_work() parked the TX worker and disabled RX/TX NAPIs before taking dev->mt76.mutex, while __mt76_set_channel() toggles the same worker ...

CVE-2026-90366

This Linux kernel vulnerability affects the mt76/mt7996 WiFi driver (MediaTek). The function mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (CSA countdown and CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved space for one. With MBSSID enabled and a near-maximum beacon ...

CVE-2026-90365

CVE-2026-90365 affects the mt76 WiFi driver in the Linux kernel. The root cause is a workqueue ordering flaw: both mt76 drivers cancelled dump_work on device unregister but left reset_work and rc_work to be flushed only later by destroy_workqueue() in mt76_free_device(), which runs after the hard...

CVE-2026-90364

CVE-2026-90364 affects the Linux kernel ACPI processor driver. In acpi_processor_driver_init(), the cpufreq policy notifier is registered before the ACPI processor driver and CPU hotplug state are set up. If driver_register() or cpuhp_setup_state() fails, the error path unregisters the ACPI proce...

CVE-2026-90362

CVE-2026-90362 affects the Linux kernel 's drm/msm/dsi driver (Qualcomm Display Serial Interface). The root cause is an explicit call to dev_pm_opp_set_rate(0) , which removes the operating performance point vote specified in required-opps but does not actually park the clock, leaving it running ...

CVE-2026-90363

CVE-2026-90363 affects the Linux kernel DRM MSM (Qualcomm) display driver . When the KMS initialization function (mdp4_kms_init() or mdp5_kms_init()) fails partway through, the individual display drivers tear down KMS state before returning the error. The common error path in msm_drm_init() then ...

CVE-2026-90361

CVE-2026-90361 is a memory leak in the Linux kernel's ath11k WiFi driver, specifically in the ath11k_service_ready_ext_event() function. During TLV parsing, svc_rdy_ext.mac_phy_caps is allocated as a temporary buffer. It is freed on the success path but not on the error path , so if TLV parsing s...

CVE-2026-90360

CVE-2026-90360 affects the Linux kernel regulator core subsystem. The regulator_init_complete_work delayed work, which fires approximately 30 seconds after boot to disable unused regulators over I2C , was scheduled on system_wq —a non-freezable workqueue. This allowed it to execute concurrently w...

CVE-2026-90359

CVE-2026-90359 affects the Linux kernel BPF subsystem. The btf_distill_func_proto() function, which builds the function model for fentry/fexit/fmod_ret/fsession trampolines and struct_ops , has accepted 16-byte __int128 return values since the trampoline was introduced. However, the BPF trampolin...

CVE-2026-90358

CVE-2026-90358 affects the Linux kernel BPF subsystem on x86 . The root cause is in the x86 trampoline: when a BPF program is called with a 128-bit scalar argument (e.g., __int128, arg_size == 16), the trampoline incorrectly assumes it needs only one register. This under-allocates the register sa...

CVE-2026-90356

CVE-2026-90356 is a use-after-free vulnerability in the Linux kernel's mt76 Wi-Fi driver (mt7996/MediaTek). During a full device reset, mt7996_mac_reset_vif_iter() queues non-default virtual interface (vif) links for kfree_rcu while dev->wcid[] still holds pointers to the WCID structures embed...

CVE-2026-90357

CVE-2026-90357 is a memory-corruption bug in the Linux kernel's mt76 mt7915 WiFi driver. When the MCU (firmware) rejects a TWT (Target Wake Time) agreement, the error path fails to unlink the flow from dev->twt_list while leaving flowid_mask unset. The flow slot can then be reused and memset w...

CVE-2026-90355

CVE-2026-90355 affects the mt76/mt7996 WiFi driver in the Linux kernel. After a full chip reset, the reset path frees link structures without clearing the valid_links bits or the MLD index masks. When mac80211 replays its reconfiguration, mt7996_vif_link_add() short-circuits because the link IDs ...

CVE-2026-90354

CVE-2026-90354 affects the Linux kernel mt76/mt7915 Wi-Fi driver. The function mt7915_pci_init_hif2() was invoked unconditionally and a second time inside the WED-inactive branch, causing the global hif_idx to be double-incremented, the PCIe RECOG_ID register to be written twice, and a device ref...

CVE-2026-90353

CVE-2026-90353 is a use-after-free vulnerability in the Linux kernel's mt76/mt7915 Wi-Fi driver. After mt7915_register_ext_phy() succeeds, a failure in mt7915_init_debugfs() or mt7915_coredump_register() causes the error path (free_phy2) to call ieee80211_free_hw() on the external PHY while it is...

CVE-2026-90352

CVE-2026-90352 affects the mt76: mt7915 WiFi driver in the Linux kernel . The root cause is a resource leak : the hif2 reference obtained by mt7915_pci_init_hif2() is only released on error paths that key off dev->hif2, which is not assigned until after IRQ setup. If pci_alloc_irq_vectors() or...

CVE-2026-90351

This vulnerability affects the Linux kernel mt76:mt7996 Wi-Fi driver's WED (Wireless Event Device) attach path. When the WED attach for the primary PCIe function fails during probe, the driver still attaches wed_hif2 for the secondary function, leaving the device in an inconsistent half-WED confi...

CVE-2026-90350

CVE-2026-90350 affects the mt76 WiFi driver in the Linux kernel (mt7996 variant). The function mt76_vif_link() indexes the mvif->link[] array without validating link_id. Callers pass deflink_id, which holds IEEE80211_LINK_UNSPECIFIED (0xf) until the first link is added. Since IEEE80211_MLD_MAX...