Executive brief
The Linux kernel's Mediatek WiFi driver (mt7996) fails to properly clean up internal state when the wireless chip undergoes a full hardware reset. This causes the device to become inoperative after restart and progressively exhausts internal resource pools with repeated resets, eventually rendering the WiFi adapter non-functional.
Technical details
The vulnerability is a state management bug in the mt76 driver's mt7996 chipset support. During full chip reset, the driver frees link data structures but fails to clear the valid_links bitmap and MLD index masks. When mac80211 replays the interface configuration during reconfig, the stale link state causes mt7996_vif_link_add() to short-circuit, preventing re-creation of firmware records and link registration. Additionally, MLD indices are re-allocated without clearing old bits in the allocation masks, causing resource leaks. Repeated resets exhaust the index space, leaving the device inoperative. The fix clears valid_links in the reset iterator and resets MLD index masks during full reset. No authentication or network access required; this is triggered by normal chip reset events.
Affected products
- Linux Linux kernel affected versions not explicitly specified; fix integrated in stable kernels
Timeline
- 2026-09-17: disclosed: CVE-2026-90355 published
- 2026-07-24: patched: Fix committed by Felix Fietkau
- 2026-09-14: patched: Integrated into stable kernels