Executive brief
The Linux kernel mt76 wireless driver for MediaTek MT7996 chips has a logic flaw in WED (Wireless Engine Dispatcher) device initialization. When the primary wireless device fails to attach its WED accelerator, the driver incorrectly continues to attach a secondary WED device, leaving the hardware in an inconsistent state that causes crashes. This affects systems using MT7996-based WiFi adapters.
Technical details
The vulnerability is a logic error in the mt7996_mmio_wed_init() function in drivers/net/wireless/mediatek/mt76/mt7996/mmio.c. When WED attachment fails for the primary PCIe function, the code still attempts to attach WED for the secondary function (hif2), and also incorrectly re-enables hwrro_mode which had been disabled by the failed primary attachment. This creates an inconsistent half-WED configuration that crashes during later operation. The fix adds a simple check: if hif2 WED attachment is being attempted and the primary WED device is not active, the function returns early to skip the secondary attachment. No special privileges or network access are required; the issue manifests during device probe/initialization.
Affected products
- Linux Linux kernel Linux 5.x through 7.x (mt76 driver with MT7996 support)
Timeline
- 2026-09-17: disclosed: CVE-2026-90351 published on NVD
- 2026-08-01: patched: Upstream commit 7c1924332e986019c6bcddf55c843361cccac73f
- 2026-09-14: patched: Stable kernel backport commit 76144da3c6184c7850631ad79d0600ac8bf7649a