Executive brief
A wireless driver in the Linux kernel could read or write data beyond allocated buffer boundaries when processing memory-mapped I/O operations with unaligned data lengths. This memory safety issue could allow local attackers to trigger kernel crashes or potentially leak sensitive data from kernel memory.
Technical details
The mt76_mmio_write_copy() and mt76_mmio_read_copy() functions in the Mediatek mt76 WiFi driver iterate up to ALIGN(len, 4), causing buffer over-reads (in write_copy) or over-writes (in read_copy) when the data length is not a multiple of 4 bytes. The vulnerability exists in the memory-mapped I/O helpers that copy data between kernel memory and device registers. The fix changes the loop condition to only iterate over complete 4-byte aligned chunks (i + 4 <= len) and handles remaining bytes via a temporary 4-byte bounce buffer. This is a local kernel issue with no network attack vector; exploitation requires kernel code execution context.
Affected products
- Linux Linux kernel all versions with drivers/net/wireless/mediatek/mt76/mmio.c (kernel 5.6+)
Timeline
- 2026-09-17: disclosed: CVE-2026-90369 published
- 2026-07-24: patched: Patch committed by Felix Fietkau
- 2026-09-14: patched: Fix backported to stable kernels