Executive brief
The Linux kernel's MT7915 WiFi driver contains a bug in Target Wake Time (TWT) agreement handling that corrupts the driver's internal flow list when the firmware rejects a TWT setup. This can lead to system instability, crashes, or denial of service on devices using this WiFi chip (primarily MediaTek MT7915 and similar devices).
Technical details
The vulnerability is a use-after-free and list corruption flaw in the mt7915_mac_add_twt_setup() function. The flow object is added to dev->twt_list before sending the TWT agreement to the MCU firmware. When the firmware rejects the agreement (mt7915_mcu_twt_agrt_update() returns an error), the error path fails to unlink the flow from the list while leaving flowid_mask unset. Subsequently, the flow slot can be reused and memset while still linked, corrupting the twt_list structure. Station removal may also leave a dangling entry that mt7915_mac_twt_sched_list_add() later attempts to walk, causing memory corruption or kernel crashes. The fix adds a list_del(&flow->list) call in the error path to properly unlink the flow.
Affected products
- Linux Linux kernel 5.0 and later (affected by the vulnerable code path in mt76 mt7915 driver)
Timeline
- 2026-09-17: disclosed: CVE-2026-90357 published
- 2026-07-24: patched: Fix committed by Felix Fietkau (upstream commit 16a04441eab0dcd)
- 2026-09-14: patched: Backported to stable kernel series