Executive brief
The Linux kernel's mt76 WiFi driver incorrectly tracked packet statistics for multi-link access point stations, causing the transmit scheduler to permanently stop servicing stations when certain packet counters overflowed. This affected the ability of wireless clients using multiple frequency bands (2G/5G) to communicate with the access point.
Technical details
The vulnerability is a logic error in the mt76 WiFi driver's __mt76_tx_queue_skb() function. When processing packets from stations using multi-link operation (MLO), the driver incorrectly reassigned the wireless connection ID (wcid) after TX, causing non-AQL packet counters to be incremented on one link (e.g., 5G) but decremented on another (e.g., 2G). When the inflated counter exceeded MT_MAX_NON_AQL_PKT, the TX scheduler permanently refused to service the affected station. The fix removes the incorrect wcid reassignment, accounting packets on the wcid actually used for transmission. This is a kernel-space logic bug with no authentication or network preconditions; affected systems are those running the vulnerable kernel versions with mt76 WiFi hardware.
Affected products
- Linux Linux kernel Versions prior to commit 8ae659743ba936b22ecb4620815887728e2820d6
Timeline
- 2026-09-17: disclosed: CVE-2026-90375 published
- 2026-07-31: patched: Upstream patch commit 8ae659743ba936b22ecb4620815887728e2820d6