Executive brief
The Linux kernel's mt76 WiFi driver contains an integer underflow bug in spatial stream (nss) calculation for MediaTek MT7915 chipsets. When a peer device reports no supported spatial streams, the function returns an incorrect value (255) that gets written to firmware beamforming settings, potentially causing incorrect WiFi behavior or device instability.
Technical details
An integer underflow vulnerability exists in the mt7915_mcu_get_sta_nss() function within drivers/net/wireless/mediatek/mt76/mt7915/mcu.c. When a peer's VHT/HE MCS map contains no supported spatial streams (all fields set to 0x3), the loop counter nss exits at 0. The function then returns (u8)-1, which wraps to 255 as an unsigned 8-bit value. This corrupted value is written into firmware station record beamforming fields, potentially affecting transmit beamforming behavior. The fix clamps the result to 0 when nss is 0, ensuring a valid value is always returned. No remote exploitation is required—the issue is triggered by legitimate peer capability advertisements during WiFi association.
Affected products
- Linux Linux kernel Affected in versions with mt76 mt7915 driver (since introduction of beamformer support in commit 89029a85482c)
Timeline
- 2026-09-17: disclosed: CVE-2026-90372 published
- 2026-09-14: patched: Upstream fix committed (upstream commit 4a2f4be532e3ea4e2b536e411793a05aaa51af25)