Junglewise Threat Intelligence

CVE-2026-90371: Linux kernel mt76 RXDMAD_C buffer recycling race condition

CVE-2026-90371 · Severity: high · CVSS 8.8 · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's mt76 WiFi driver contains a race condition in how it recycles memory buffers used for receiving wireless data (RXDMAD_C buffers). This buffer mismanagement could cause memory corruption or system instability on devices using Mediatek WiFi chipsets, potentially leading to denial of service or data loss.

Technical details

The vulnerability is a race condition in the mt76 DMA buffer management code (drivers/net/wireless/mediatek/mt76/dma.c). RXDMAD_C buffers are allocated from page pools bound to a different NAPI (network API) context than the receiving queue, but the code was using direct page-pool recycling that could race with the owning NAPI thread. The fix disables direct page-pool recycling for these buffers by adding a check (!mt76_queue_is_wed_rro_rxdmad_c) to the allow_direct flag, forcing the use of a safer non-direct recycling path. This is a memory-safety issue affecting the kernel's wireless driver subsystem that requires no user interaction or authentication to trigger.

Affected products

  • Linux Linux kernel affected versions include linux-5.10.y through linux-6.x.y series

Timeline

  • 2026-09-17: disclosed: Published in NVD
  • 2026-09-14: patched: Fix committed by Greg Kroah-Hartman on 2026-09-14

References

Related threats