Executive brief
The mt76 wireless driver in the Linux kernel has a data processing bug in RRO 3.0 (Reorder Reference Object) mode that causes received network packets to be queued to the wrong internal processing queue. This causes packets to stall and arrive out of order, degrading wireless performance and data delivery reliability.
Technical details
This is a logic bug in the mt76_rx_release_amsdu function in drivers/net/wireless/mediatek/mt76/mac80211.c. For RRO 3.0 hardware offload, received data frames released from a RRO data queue must be queued to the indicator queue (MT_RXQ_RRO_IND), not the data queue, because the indicator queue's NAPI handler is the only path that processes these frames. When frames were incorrectly queued to the data queue, they would stall until the data queue NAPI happened to run, causing reordering and delivery delays. The fix adds a conditional check: if the queue is a WED RRO data queue and the device is in MT76_HWRRO_V3 mode, redirect the frame to the indicator queue before queuing. The patch was merged in the Linux kernel mainline and stable branches.
Affected products
- Linux Linux kernel Affected versions in mt76 driver; patched in mainline and stable branches
Timeline
- 2026-09-17: disclosed: CVE-2026-90377 published
- 2026-07-31: patched: Upstream fix merged by Felix Fietkau