CVE-2026-90381 (GCVE-0-2026-90381)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:54
VLAI
Title
wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each struct ieee80211_vif_chanctx_switch. Rework mt76_switch_vif_chanctx() to properly handle this scenario.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82334623af0cd2154633cdb007719a321048fafc , < 063169a2755abdcbe7698d98360336abb6bef414 (git)
Affected: 82334623af0cd2154633cdb007719a321048fafc , < 70869cc429fffc77de51e7777c0ecb651e8fca07 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "063169a2755abdcbe7698d98360336abb6bef414",
              "status": "affected",
              "version": "82334623af0cd2154633cdb007719a321048fafc",
              "versionType": "git"
            },
            {
              "lessThan": "70869cc429fffc77de51e7777c0ecb651e8fca07",
              "status": "affected",
              "version": "82334623af0cd2154633cdb007719a321048fafc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()\n\nWhen performing channel switches on different radios within a short\ntimeframe, channel contexts with different bands can be carried for\neach struct ieee80211_vif_chanctx_switch.\n\nRework mt76_switch_vif_chanctx() to properly handle this scenario."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - CSA IEs in a received Beacon (ieee80211_rx_mgmt_beacon \u2192 ieee80211_sta_process_chanswitch \u2192 ieee80211_link_reserve_chanctx) or Channel Switch action frame (ieee80211_sta_rx_queued_mgmt) make ieee80211_chsw_switch_vifs call mt76_switch_vif_chanctx with one ieee80211_vif_chanctx_switch per radio; those 802.11 frames are radio-range, not a routable IP protocol.\nAC:L - ieee80211_vif_use_reserved_switch returns -EAGAIN until every in-place reservation is reserved_ready, then ieee80211_chsw_switch_vifs batches them into one CHANCTX_SWMODE_SWAP_CONTEXTS call; an AP/MLD that puts CSA IEs on two mt7996 bands with matching counts makes both ready in order with no victim-only race.\nPR:N - ieee80211_rx_mgmt_beacon only needs ieee80211_rx_our_beacon() BSSID match on an associated STA, and mt7996 sets CHANCTX_STA_CSA so this path is used; beacons are unauthenticated, so the AP or a radio-range BSSID spoof needs no Linux capability or account.\nUI:N - An already-associated station runs ieee80211_csa_switch_work \u2192 ieee80211_link_use_reserved_context when the CSA count elapses and automatically enters mt76_switch_vif_chanctx; no extra click, reconnect, or mount is required at trigger time.\nS:U - Aliased mlink-\u003ectx, the leftover phy-\u003echanctx on non-first radios, and any resulting host-kernel heap UAF stay inside this machine\u2019s mt76/mac80211; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The pre-fix function set every mlink-\u003ectx to vifs[0].new_ctx. After that first ieee80211_chanctx is kfree_rcu\u2019d (ieee80211_free_chanctx when the first vif/link unassigns while others remain), mt76_vif_link_phy() still does mlink-\u003ectx-\u003edrv_priv and reads ctx-\u003ephy from the freed object, a kernel info-leak UAF.\nI:H - The same dangling mlink-\u003ectx makes mt76_vif_link_phy() return ctx-\u003ephy from reallocatable freed ieee80211_chanctx memory; callers such as mt7996_link_info_changed then issue MCU updates (mt7996_mcu_add_bss_info and similar) through that forged mt76_phy pointer, a kernel write/control-flow primitive.\nA:H - mt76_vif_link_phy() on the stale mlink-\u003ectx oopses after the aliased chanctx is freed; the pre-fix path also skipped mt76_phy_update_channel for every radio but vifs[0], leaving that PHY\u2019s phy-\u003echanctx pointing at the old ctx that ieee80211_vif_use_reserved_switch kfree_rcu\u2019s, taking the radio down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:58.601Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/063169a2755abdcbe7698d98360336abb6bef414"
        },
        {
          "url": "https://git.kernel.org/stable/c/70869cc429fffc77de51e7777c0ecb651e8fca07"
        }
      ],
      "title": "wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90381",
    "datePublished": "2026-09-17T16:09:18.603Z",
    "dateReserved": "2026-09-11T19:38:34.809Z",
    "dateUpdated": "2026-09-18T17:54:58.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90381",
      "date": "2026-09-29",
      "epss": "0.0034",
      "percentile": "0.25004"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/channel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "063169a2755abdcbe7698d98360336abb6bef414",
                    "status": "affected",
                    "version": "82334623af0cd2154633cdb007719a321048fafc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "70869cc429fffc77de51e7777c0ecb651e8fca07",
                    "status": "affected",
                    "version": "82334623af0cd2154633cdb007719a321048fafc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/channel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()\n\nWhen performing channel switches on different radios within a short\ntimeframe, channel contexts with different bands can be carried for\neach struct ieee80211_vif_chanctx_switch.\n\nRework mt76_switch_vif_chanctx() to properly handle this scenario."
          }
        ],
        "id": "CVE-2026-90381",
        "lastModified": "2026-09-18T18:17:56.307",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:37.397",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/063169a2755abdcbe7698d98360336abb6bef414"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/70869cc429fffc77de51e7777c0ecb651e8fca07"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:29:15Z",
      "cve": "CVE-2026-90381",
      "id": "CVE-2026-90381",
      "initial_release_date": "2026-09-22T16:29:15Z",
      "product_status:known_affected": "12",
      "product_status:known_not_affected": "335",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90381",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90381.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.