CVE-2026-90380

Published: Set 17, 2026 Last Modified: Set 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Attack Vector: adjacent_network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

A use-after-free issue occurs in mt76_rx_poll_complete due to a race
condition. The STA has already been removed, but the rx_status still
had a pointer to the wcid in the STA.

Set the links' wcid pointers to be NULL for a MLD in
mt7925_sta_pre_rcu_remove()

BUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470
Call trace:
dump_backtrace+0xec/0x128
show_stack+0x18/0x28
dump_stack_lvl+0x40/0xc8
print_report+0x1b8/0x710
kasan_report+0xe0/0x144
do_bad_area+0x120/0x260
do_tag_check_fault+0x20/0x34
do_mem_abort+0x54/0xa8
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x40/0xcc
el1h_64_sync+0x7c/0x80
mt76_rx_poll_complete+0x280/0x470
mt76_dma_rx_poll+0x114/0x51c
mt792x_poll_rx+0x60/0xf8
napi_threaded_poll_loop+0xe0/0x450
napi_threaded_poll+0x80/0x9c
kthread+0x11c/0x158
ret_from_fork+0x10/0x20

https://git.kernel.org/stable/c/217f9e7bb02558759be9d9ecfe5…
https://git.kernel.org/stable/c/217f9e7bb02558759be9d9ecfe532e9708741c50
https://git.kernel.org/stable/c/aaf414bf81ab4b680580871784b…
https://git.kernel.org/stable/c/aaf414bf81ab4b680580871784b0b929818188eb
https://git.kernel.org/stable/c/b250943f3f8351385a17972bda0…
https://git.kernel.org/stable/c/b250943f3f8351385a17972bda001664a5c51008