Executive brief
The mt76 WiFi driver for MediaTek chipsets contains a memory leak in its SDIO transmit (TX) path when handling certain network packets. When the driver rejects zero-length frames to prevent hardware hangs, it fails to properly free the associated memory, causing cumulative resource exhaustion. Repeated exploitation would degrade system performance and eventually cause denial of service.
Technical details
The vulnerability is a memory leak in the mt76s_tx_queue_skb() function (drivers/net/wireless/mediatek/mt76/sdio.c) where socket buffers (skb) are not freed when tx_prepare_skb() returns an error. The root cause occurs when zero-length frames (such as WNM NULL frames) are dropped to prevent potential hardware TX hangs. The function path is reachable via the SDIO interface without authentication, but exploitation requires transmitting specific malformed or zero-length frames. The fix properly releases the skb using ieee80211_tx_status_ext() when tx_prepare_skb() fails, ensuring all memory is returned to the kernel. This is a low-severity issue since it requires repeated transmission of special packets and merely causes gradual resource depletion rather than immediate security compromise.
Affected products
- Linux Linux kernel all versions with mt76 driver (especially mt7915/mt792x)
Timeline
- 2026-09-17: disclosed: CVE-2026-90378 published
- 2026-09-14: patched: Patch merged into stable kernel via commit 6a342db7a6502bc6781579145e05d4d4731786ab