Junglewise Threat Intelligence

CVE-2026-90375: Linux kernel mt76 driver packet accounting logic error

CVE-2026-90375 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's mt76 WiFi driver incorrectly tracked packet statistics for multi-link access point stations, causing the transmit scheduler to permanently stop servicing stations when certain packet counters overflowed. This affected the ability of wireless clients using multiple frequency bands (2G/5G) to communicate with the access point.

Technical details

The vulnerability is a logic error in the mt76 WiFi driver's __mt76_tx_queue_skb() function. When processing packets from stations using multi-link operation (MLO), the driver incorrectly reassigned the wireless connection ID (wcid) after TX, causing non-AQL packet counters to be incremented on one link (e.g., 5G) but decremented on another (e.g., 2G). When the inflated counter exceeded MT_MAX_NON_AQL_PKT, the TX scheduler permanently refused to service the affected station. The fix removes the incorrect wcid reassignment, accounting packets on the wcid actually used for transmission. This is a kernel-space logic bug with no authentication or network preconditions; affected systems are those running the vulnerable kernel versions with mt76 WiFi hardware.

Affected products

  • Linux Linux kernel Versions prior to commit 8ae659743ba936b22ecb4620815887728e2820d6

Timeline

  • 2026-09-17: disclosed: CVE-2026-90375 published
  • 2026-07-31: patched: Upstream patch commit 8ae659743ba936b22ecb4620815887728e2820d6

References

Related threats