Executive brief
The MT76 WiFi drivers for MediaTek chipsets (MT7915 and MT7996) failed to properly cancel pending work tasks during device unregistration, leaving cleanup operations to be processed after hardware resources were already released. This could cause system instability or crashes when a WiFi adapter is removed or unloaded while internal reset or rate-control operations are pending.
Technical details
The vulnerability is a race condition in work queue management within the MT76 WiFi driver family. The vulnerable code in mt7915/init.c and mt7996/init.c only cancelled dump_work during unregister, but left reset_work and rc_work to be flushed by destroy_workqueue() in mt76_free_device()—which runs after the hardware is unregistered and stopped. A reset_work firing in this window could call ieee80211_restart_hw() and re-arm mac_work on an unregistered device, while rc_work could access station state being torn down, causing use-after-free conditions. The fix proactively cancels reset_work and rc_work alongside dump_work during device unregister. No authentication or network reachability is required; the issue manifests during local device hot-removal or driver unload.
Affected products
- Linux Linux kernel versions with MT7915 or MT7996 drivers; fixed in commit e995d3dccc9d980af13a60ad37409ed1561f9eeb
- MediaTek MT7915 all versions with MT76 driver
- MediaTek MT7996 all versions with MT76 driver
Timeline
- 2026-09-17: disclosed: CVE-2026-90365 published in NVD
- 2026-07-24: patched: Upstream fix commit e995d3dccc9d980af13a60ad37409ed1561f9eeb authored
- 2026-09-14: patched: Stable kernel backport commit c4dc85481d38951ca7f8bc104e711936306cc664 released