CVE-2026-90353 (GCVE-0-2026-90353)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:54
VLAI
Title
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw. Unregister the ext PHY (thermal + phy + hw) first and skip the redundant free.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7b8e1ae886e45aed9274048f2836a70b75ecfa40 , < aa55bec92ba7747dd08feff409f8074c5e052e71 (git)
Affected: 7b8e1ae886e45aed9274048f2836a70b75ecfa40 , < ad706fcf6255494613b94418e7243d98065dbeaf (git)
Affected: 7b8e1ae886e45aed9274048f2836a70b75ecfa40 , < 34058ad122f7524e33df8e38caba4b1d803b025a (git)
Affected: 7b8e1ae886e45aed9274048f2836a70b75ecfa40 , < a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5 (git)
Affected: 7b8e1ae886e45aed9274048f2836a70b75ecfa40 , < 648f5f03ff50d4bd719106ace0cdf1d8be02cbdd (git)
Affected: 7b8e1ae886e45aed9274048f2836a70b75ecfa40 , < 15b960014f24dce5388d4a2e7274e6490cb3c421 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa55bec92ba7747dd08feff409f8074c5e052e71",
              "status": "affected",
              "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
              "versionType": "git"
            },
            {
              "lessThan": "ad706fcf6255494613b94418e7243d98065dbeaf",
              "status": "affected",
              "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
              "versionType": "git"
            },
            {
              "lessThan": "34058ad122f7524e33df8e38caba4b1d803b025a",
              "status": "affected",
              "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
              "versionType": "git"
            },
            {
              "lessThan": "a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5",
              "status": "affected",
              "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
              "versionType": "git"
            },
            {
              "lessThan": "648f5f03ff50d4bd719106ace0cdf1d8be02cbdd",
              "status": "affected",
              "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
              "versionType": "git"
            },
            {
              "lessThan": "15b960014f24dce5388d4a2e7274e6490cb3c421",
              "status": "affected",
              "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix ext PHY use-after-free on register error path\n\nAfter mt7915_register_ext_phy() succeeded, a failure of the main PHY\nmt7915_init_debugfs() or mt7915_coredump_register() unwound through\nfree_phy2, which called ieee80211_free_hw() on the ext PHY hw while it\nwas still registered with mac80211, since mt76_unregister_device() only\nunregisters the main hw. Unregister the ext PHY (thermal + phy + hw)\nfirst and skip the redundant free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in mt7915_register_device()\u0027s free_phy2 unwind, reached only from mt7915_pci_probe() and mt798x_wmac_probe() when mt7915_init_debugfs() or mt7915_coredump_register() fails after mt7915_register_ext_phy(); no 802.11 frame or nl80211 command supplies the triggering data.\nAC:H - mt7915_init_debugfs() always returns 0, so the live branch is mt7915_coredump_register() failing its vzalloc of struct mt7915_crash_data after mt7915_alloc_ext_phy() produced phy2 (DBDC). That one-shot ENOMEM during pci/platform probe is not something an attacker can reliably force.\nPR:L - After ieee80211_free_hw() on the still-registered ext PHY, mt76_unregister_device() drops only the main hw, leaving the ext wiphy, the default STA vif from ieee80211_register_hw(), and mt7915_thermal_ops (cdev-\u003edevdata = phy) reachable via nl80211 and thermal sysfs without init-namespace root or PCI bind capability.\nUI:N - No victim must mount media or open a file; once the probe unwind runs, udev, mac80211\u0027s leftover workqueue/inetaddr notifier, or the attacker\u2019s own nl80211/thermal access touches the still-registered ext PHY.\nS:U - ieee80211_free_hw() frees the ext PHY\u0027s ieee80211_local/wiphy/sband while mac80211 still holds it; impact is host-kernel heap corruption, not a VM, IOMMU, or sandbox escape.\nC:H - ieee80211_free_hw() kfree\u0027s the ext PHY\u0027s still-registered wiphy bands and wiphy_free()s the hw while cfg80211 and mt7915_thermal_get_cur_throttle_state() still dereference that phy via cdev-\u003edevdata, a UAF read primitive.\nI:H - The leftover ext-PHY object is written by mt7915_thermal_set_cur_throttle_state() (phy-\u003ecdev_state and mt7915_mcu_set_thermal_throttling) and by mac80211 workqueues never torn down by ieee80211_unregister_hw(), enabling UAF writes and control-flow hijack.\nA:H - ieee80211_free_hw() without ieee80211_unregister_hw() leaves mac80211 workqueues, inetaddr notifiers, and the default wlan vif running against freed ieee80211_local, which oopses or panics on the next access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:48.057Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa55bec92ba7747dd08feff409f8074c5e052e71"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad706fcf6255494613b94418e7243d98065dbeaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/34058ad122f7524e33df8e38caba4b1d803b025a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/648f5f03ff50d4bd719106ace0cdf1d8be02cbdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/15b960014f24dce5388d4a2e7274e6490cb3c421"
        }
      ],
      "title": "wifi: mt76: mt7915: fix ext PHY use-after-free on register error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90353",
    "datePublished": "2026-09-17T16:09:00.217Z",
    "dateReserved": "2026-09-11T19:38:34.805Z",
    "dateUpdated": "2026-09-18T17:54:48.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90353",
      "date": "2026-09-25",
      "epss": "0.00151",
      "percentile": "0.0358"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/init.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "aa55bec92ba7747dd08feff409f8074c5e052e71",
                    "status": "affected",
                    "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad706fcf6255494613b94418e7243d98065dbeaf",
                    "status": "affected",
                    "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "34058ad122f7524e33df8e38caba4b1d803b025a",
                    "status": "affected",
                    "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5",
                    "status": "affected",
                    "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "648f5f03ff50d4bd719106ace0cdf1d8be02cbdd",
                    "status": "affected",
                    "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15b960014f24dce5388d4a2e7274e6490cb3c421",
                    "status": "affected",
                    "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/init.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix ext PHY use-after-free on register error path\n\nAfter mt7915_register_ext_phy() succeeded, a failure of the main PHY\nmt7915_init_debugfs() or mt7915_coredump_register() unwound through\nfree_phy2, which called ieee80211_free_hw() on the ext PHY hw while it\nwas still registered with mac80211, since mt76_unregister_device() only\nunregisters the main hw. Unregister the ext PHY (thermal + phy + hw)\nfirst and skip the redundant free."
          }
        ],
        "id": "CVE-2026-90353",
        "lastModified": "2026-09-18T18:17:55.010",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:34.140",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15b960014f24dce5388d4a2e7274e6490cb3c421"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/34058ad122f7524e33df8e38caba4b1d803b025a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/648f5f03ff50d4bd719106ace0cdf1d8be02cbdd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aa55bec92ba7747dd08feff409f8074c5e052e71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ad706fcf6255494613b94418e7243d98065dbeaf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.