wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915_remove_interface() cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the allocators, which all run under dev->mt76.mutex; on DBDC the two wiphys share one mt76_dev, so this raced add_interface/sta_add on the other band and could leak or double-hand-out a wcid. Clearing the bit before the RCU pointer also let a concurrent allocation reuse the index and publish its wcid, which the subsequent NULL assignment then wiped. Move the clear into the existing mutex section, after the RCU pointer is cleared.
CVE-2026-90373
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90373
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
"lessThan": "5dce25f1d609ba991a9c22c27be586c92f03ed77",
"versionType": "git"
},
{
"status": "affected",
"version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
"lessThan": "b4a41a47a67c788e6b0625fa517ec8872e99bb6c",
"versionType": "git"
},
{
"status": "affected",
"version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
"lessThan": "a97b2b942d2f8f12fbd6a7caafc735d1ad115e6b",
"versionType": "git"
},
{
"status": "affected",
"version": "f3049b88b2b32326df97461813ae73e8bbc296fc",
"lessThan": "6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba",
"versionType": "git"
},
{
"status": "affected",
"version": "a582b1d54313dcdc96e7d8e1f49495dd71ddaf3e",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.160",
"lessThan": "6.7",
"versionType": "semver"
}
],
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/main.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/main.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90373
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48680 · Revision 1
- Added to Heist Feed
- Publisher date