CVE-2026-90382 (GCVE-0-2026-90382)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-17 16:09
VLAI
Title
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a corrupted frame can report a length larger than the received buffer. The bounds check correctly discards such frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage frame taints the kernel, and panics it on the first such frame when panic_on_warn is set. Drop the WARN and discard the frame silently, matching what commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx status and rx path") did for the neighboring rx and tx status paths. Observed immediately on rx with an MT7612U in fcsfail monitor mode on a busy channel.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 61b1f6d92249bc34580ff19de7c69c805f82adca (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < d55e7aede542c4c76ead82d37d0c112f21eb2ac2 (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < b6e7958602bd1acdb8ae92703b6689a28bcc9bc0 (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 2d31e332c13b1db7745a7bd9cf74bc105524bcac (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 17d6b89e09eac2d90272fceeba3644e92212e02f (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 6def491fe9c4e83aa8cba62d74e9d4ab751ee967 (git)
Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 81497634d9f872fd3e8b03aada55574afff6f174 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "61b1f6d92249bc34580ff19de7c69c805f82adca",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "d55e7aede542c4c76ead82d37d0c112f21eb2ac2",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "b6e7958602bd1acdb8ae92703b6689a28bcc9bc0",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "2d31e332c13b1db7745a7bd9cf74bc105524bcac",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "17d6b89e09eac2d90272fceeba3644e92212e02f",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "6def491fe9c4e83aa8cba62d74e9d4ab751ee967",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "81497634d9f872fd3e8b03aada55574afff6f174",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt76x02: do not WARN on invalid rx descriptor length\n\nThe MPDU length in the rx descriptor comes from the hardware. In\nmonitor mode with the fcsfail filter enabled, the hardware passes up\ncorrupted frames, and a corrupted frame can report a length larger\nthan the received buffer. The bounds check correctly discards such\nframes, but its WARN_ON_ONCE wrapper means any over-the-air garbage\nframe taints the kernel, and panics it on the first such frame when\npanic_on_warn is set.\n\nDrop the WARN and discard the frame silently, matching what\ncommit c2d4c8723dbf (\"mt76x2: remove some harmless WARN_ONs in tx\nstatus and rx path\") did for the neighboring rx and tx status paths.\n\nObserved immediately on rx with an MT7612U in fcsfail monitor mode\non a busy channel."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:09:19.247Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca"
        },
        {
          "url": "https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac"
        },
        {
          "url": "https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967"
        },
        {
          "url": "https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174"
        }
      ],
      "title": "wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90382",
    "datePublished": "2026-09-17T16:09:19.247Z",
    "dateReserved": "2026-09-11T19:38:34.809Z",
    "dateUpdated": "2026-09-17T16:09:19.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90382",
      "date": "2026-09-29",
      "epss": "0.0022",
      "percentile": "0.11193"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "61b1f6d92249bc34580ff19de7c69c805f82adca",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d55e7aede542c4c76ead82d37d0c112f21eb2ac2",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b6e7958602bd1acdb8ae92703b6689a28bcc9bc0",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d31e332c13b1db7745a7bd9cf74bc105524bcac",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "17d6b89e09eac2d90272fceeba3644e92212e02f",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6def491fe9c4e83aa8cba62d74e9d4ab751ee967",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "81497634d9f872fd3e8b03aada55574afff6f174",
                    "status": "affected",
                    "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt76x02: do not WARN on invalid rx descriptor length\n\nThe MPDU length in the rx descriptor comes from the hardware. In\nmonitor mode with the fcsfail filter enabled, the hardware passes up\ncorrupted frames, and a corrupted frame can report a length larger\nthan the received buffer. The bounds check correctly discards such\nframes, but its WARN_ON_ONCE wrapper means any over-the-air garbage\nframe taints the kernel, and panics it on the first such frame when\npanic_on_warn is set.\n\nDrop the WARN and discard the frame silently, matching what\ncommit c2d4c8723dbf (\"mt76x2: remove some harmless WARN_ONs in tx\nstatus and rx path\") did for the neighboring rx and tx status paths.\n\nObserved immediately on rx with an MT7612U in fcsfail monitor mode\non a busy channel."
          }
        ],
        "id": "CVE-2026-90382",
        "lastModified": "2026-09-17T17:17:37.503",
        "metrics": {},
        "published": "2026-09-17T17:17:37.503",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:29:14Z",
      "cve": "CVE-2026-90382",
      "id": "CVE-2026-90382",
      "initial_release_date": "2026-09-22T16:29:14Z",
      "product_status:known_affected": "176",
      "product_status:known_not_affected": "171",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90382",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90382.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.