{"id":"CVE-2026-90367","state":"PUBLISHED","title":"wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER\n\nmt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs\nbefore taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain\nkthread park/unpark, not refcounted, and __mt76_set_channel() toggles the\nsame worker and the MT76_RESET bit under the mutex. An L1 SER racing a\nchannel switch could therefore have the worker unparked and MT76_RESET\ncleared while the reset path resets the DMA rings, corrupting descriptors\nor tokens. Take the mutex before disabling the worker, as mt7915 does.","publishedAt":"2026-09-17T16:09:09.430Z","updatedAt":"2026-10-21T12:51:20.196Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"bc4f4389f439e808185778d298da36976d13d415","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"69f23622533a4f054b5c8fdb226c3319ffa017b6","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"906ad486ba5c4933d82e1ebe0685656390a48450","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"6190db312b8230813f529f014b26247c6d9800d0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"]}],"references":["https://git.kernel.org/stable/c/bc4f4389f439e808185778d298da36976d13d415","https://git.kernel.org/stable/c/69f23622533a4f054b5c8fdb226c3319ffa017b6","https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450","https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701","https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90367.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90367","state":"PUBLISHED","datePublished":"2026-09-17T16:09:09.430Z","dateUpdated":"2026-10-21T12:51:20.196Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.807Z"},"containers":{"cna":{"title":"wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER\n\nmt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs\nbefore taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain\nkthread park/unpark, not refcounted, and __mt76_set_channel() toggles the\nsame worker and the MT76_RESET bit under the mutex. An L1 SER racing a\nchannel switch could therefore have the worker unparked and MT76_RESET\ncleared while the reset path resets the DMA rings, corrupting descriptors\nor tokens. Take the mutex before disabling the worker, as mt7915 does."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"bc4f4389f439e808185778d298da36976d13d415","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"69f23622533a4f054b5c8fdb226c3319ffa017b6","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"906ad486ba5c4933d82e1ebe0685656390a48450","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701","versionType":"git"},{"version":"27015b6fbcca836c6dbf196afc266e068af4aeec","status":"affected","lessThan":"6190db312b8230813f529f014b26247c6d9800d0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/bc4f4389f439e808185778d298da36976d13d415"},{"url":"https://git.kernel.org/stable/c/69f23622533a4f054b5c8fdb226c3319ffa017b6"},{"url":"https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450"},{"url":"https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701"},{"url":"https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - mt7996_irq_tasklet() handles MT_INT_MCU_CMD, reads MT_MCU_CMD, and on ERROR_MASK (including STOP_DMA) calls mt7996_reset() to queue L1 SER; the racing worker toggle is __mt76_set_channel() from mt76_switch_vif_chanctx() on an 802.11 Channel Switch Announcement. Both legs are WiFi radio-range, not a routable IP protocol.\nAC:L - A radio peer can drive both sides: emit CSA so ieee80211_csa_switch_work() runs mt76_switch_vif_chanctx()/__mt76_set_channel() (unparking the non-refcounted tx_worker under dev->mt76.mutex) and induce firmware L1 SER so mt7996_mac_reset_work() parks that worker before taking the mutex. The MCU channel-switch hold and napi_disable() are a retryable millisecond window.\nPR:N - mt7996_irq_tasklet() consumes MT_MCU_CMD and queues reset_work with no capable() or 802.11 authentication gate; CSA is parsed from beacons/action frames in ieee80211_sta_process_chanswitch() without a host uid. An unauthenticated (SER) or associated (CSA) radio peer needs no Linux privilege.\nUI:N - ieee80211_csa_switch_work() applies CSA automatically once the STA is associated, and mt7996_mac_reset_work() runs from the driver workqueue after the MCU IRQ. No local user must write debugfs sys_recovery or issue nl80211 SET_CHANNEL to create the race.\nS:U - The corrupted TX DMA descriptors (mt76_dma_queue_reset of q->desc[]) and token IDR (mt7996_tx_token_put()/idr_destroy()) belong to this host's mt7996 driver; the race does not cross a VM, IOMMU, or sandbox authority.\nC:H - If __mt76_set_channel() unparks tx_worker while mt7996_mac_reset_work() still runs mt7996_dma_reset() and mt7996_tx_token_put(), the worker can idr_alloc on a destroyed token IDR and DMA-map into q->desc[] being zeroed, a UAF/descriptor confusion that discloses kernel memory.\nI:H - The same race lets the TX worker write queue head and descriptors (mt76_dma_add_buf) while mt76_dma_queue_reset() clears q->desc[] and mt7996_tx_token_put() destroys the token IDR, a write primitive against DMA-ring and heap token objects suitable for control-flow hijack.\nA:H - Concurrent mt76_dma_tx_cleanup()/mt76_dma_queue_reset() versus a live tx_worker oopses on a freed txwi/skb or wedges the WFDMA rings; the commit's descriptor/token corruption is a kernel crash, so availability is High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:51:20.196Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}