CVE-2026-90365: Linux kernel MT76 WiFi driver work queue cleanup

CVE-2026-90365 · Severity: info · Published 2026-09-17

The MT76 WiFi drivers for MediaTek chipsets (MT7915 and MT7996) failed to properly cancel pending work tasks during device unregistration, leaving cleanup operations to be processed after hardware resources were already released. This could cause system instability or crashes when a WiFi adapter is removed or unloaded while internal reset or rate-control operations are pending.

Technologies: Linux Kernel, MediaTek Mt7915. Vendors: Linux, MediaTek.

Quick answers

Is CVE-2026-90365 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-90365 being exploited in the wild.
How severe is CVE-2026-90365?
Informational severity, published 17 September 2026.
Which products and versions are affected?
Linux Kernel versions with MT7915 or MT7996 drivers; fixed in commit e995d3dccc9d980af13a60ad37409ed1561f9eeb; MediaTek Mt7915 all versions with MT76 driver; MediaTek MT7996 all versions with MT76 driver.
Is there a fix for CVE-2026-90365?
A patch was published on 2026-07-24: Upstream fix commit e995d3dccc9d980af13a60ad37409ed1561f9eeb authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90365 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-90365?
Check whether you run Linux Kernel, MediaTek Mt7915 or MediaTek MT7996 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a race condition in work queue management within the MT76 WiFi driver family. The vulnerable code in mt7915/init.c and mt7996/init.c only cancelled dump_work during unregister, but left reset_work and rc_work to be flushed by destroy_workqueue() in mt76_free_device()—which runs after the hardware is unregistered and stopped. A reset_work firing in this window could call ieee80211_restart_hw() and re-arm mac_work on an unregistered device, while rc_work could access station state being torn down, causing use-after-free conditions. The fix proactively cancels reset_work and rc_work alongside dump_work during device unregister. No authentication or network reachability is required; the issue manifests during local device hot-removal or driver unload.

Affected products

  • Linux Linux kernel versions with MT7915 or MT7996 drivers; fixed in commit e995d3dccc9d980af13a60ad37409ed1561f9eeb
  • MediaTek MT7915 all versions with MT76 driver
  • MediaTek MT7996 all versions with MT76 driver

Timeline

  • 2026-09-17: disclosed: CVE-2026-90365 published in NVD
  • 2026-07-24: patched: Upstream fix commit e995d3dccc9d980af13a60ad37409ed1561f9eeb authored
  • 2026-09-14: patched: Stable kernel backport commit c4dc85481d38951ca7f8bc104e711936306cc664 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.