CVE-2026-90357 (GCVE-0-2026-90357)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-10-19 09:02
VLAI
Title
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6643 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < c09d1b15ed2dc49060303b16a296b7b8b7794cbe (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < 1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7 (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < cabe239e95b4eebf5b6c3654087b66ff9425bc7b (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < 6bce0f1280c94af8314f895f404629da09f0788c (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < beaa42b875965dbc3e80e46970e0bfa60a94c2db (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < 16a04441eab0dcd4d7126a6f66b370adbf28f96d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c09d1b15ed2dc49060303b16a296b7b8b7794cbe",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "cabe239e95b4eebf5b6c3654087b66ff9425bc7b",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "6bce0f1280c94af8314f895f404629da09f0788c",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "beaa42b875965dbc3e80e46970e0bfa60a94c2db",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "16a04441eab0dcd4d7126a6f66b370adbf28f96d",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement\n\nThe flow is added to dev-\u003etwt_list before sending the agreement to the\nfirmware, but the error path leaves it linked while flowid_mask is\nnever set. The flow slot can then be reused and memset while still on\nthe list, corrupting twt_list, and station removal leaves a dangling\nentry behind that mt7915_mac_twt_sched_list_add() later walks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - WLAN_S1G_TWT_SETUP action frames carry the TWT element into ieee80211_rx_h_action \u2192 ieee80211_process_rx_twt_action \u2192 ieee80211_s1g_rx_twt_setup \u2192 drv_add_twt_setup \u2192 mt7915_mac_add_twt_setup; the triggering bytes arrive over 802.11 radio on the AP\u2019s LAN segment, so the vector is Adjacent.\nAC:L - After mt7915_mcu_twt_agrt_update(..., MCU_TWT_AGRT_ADD) fails, a second TWT setup from the same STA does memset/INIT_LIST_HEAD on the still-linked msta-\u003etwt.flow[] slot because flowid_mask was never set. The attacker induces that ADD failure (MCU timeout or mt76_dma_tx_queue_skb_raw queue-full) with their own traffic, then retries or deauths; not a victim-only race.\nPR:N - ieee80211_process_rx_twt_action only requires rx-\u003esta on an AP with twt_responder; WLAN_CATEGORY_S1G TWT frames are not robust management frames, so MFP does not gate them. No Linux account or capability is needed: associating as a client to an open or guest mt7915 AP is enough to send the TWT setup.\nUI:N - The attacker sends the TWT Setup action frame and the follow-up retry or deauth; ieee80211_iface_work \u2192 ieee80211_s1g_rx_twt_action runs with no local user step. An already-running AP with twt_responder is standing configuration, not victim interaction during the attack.\nS:U - mt7915_mac_add_twt_setup corrupts the host kernel\u2019s dev-\u003etwt_list and the mt7915_twt_flow embedded in sta-\u003edrv_priv; impact stays inside that kernel security authority and does not cross a VM, IOMMU, or guest-to-host boundary.\nC:H - On DISASSOC, mt7915_mac_twt_teardown_flow returns immediately when flowid_mask is unset, then sta_info_free kfree\u2019s the sta while the node remains on twt_list. A later mt7915_mac_twt_sched_list_add walk reads the freed mt7915_twt_flow, a use-after-free of attacker-reallocatable sta slab.\nI:H - The retry path memset/INIT_LIST_HEAD of a still-linked flow, and list_add in mt7915_mac_twt_sched_list_add, write next/prev through corrupted or freed list nodes, yielding a kernel write primitive from list corruption and the DISASSOC use-after-free.\nA:H - mt7915_mac_twt_sched_list_add walking the corrupted or dangling twt_list oopses on a freed mt7915_twt_flow or spins forever on a self-linked node after INIT_LIST_HEAD, hanging or panicking the AP kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:02:13.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c09d1b15ed2dc49060303b16a296b7b8b7794cbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cabe239e95b4eebf5b6c3654087b66ff9425bc7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bce0f1280c94af8314f895f404629da09f0788c"
        },
        {
          "url": "https://git.kernel.org/stable/c/beaa42b875965dbc3e80e46970e0bfa60a94c2db"
        },
        {
          "url": "https://git.kernel.org/stable/c/16a04441eab0dcd4d7126a6f66b370adbf28f96d"
        }
      ],
      "title": "wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90357",
    "datePublished": "2026-09-17T16:09:02.873Z",
    "dateReserved": "2026-09-11T19:38:34.806Z",
    "dateUpdated": "2026-10-19T09:02:13.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90357",
      "date": "2026-11-10",
      "epss": "0.00341",
      "percentile": "0.27869"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c09d1b15ed2dc49060303b16a296b7b8b7794cbe",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cabe239e95b4eebf5b6c3654087b66ff9425bc7b",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6bce0f1280c94af8314f895f404629da09f0788c",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "beaa42b875965dbc3e80e46970e0bfa60a94c2db",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16a04441eab0dcd4d7126a6f66b370adbf28f96d",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement\n\nThe flow is added to dev-\u003etwt_list before sending the agreement to the\nfirmware, but the error path leaves it linked while flowid_mask is\nnever set. The flow slot can then be reused and memset while still on\nthe list, corrupting twt_list, and station removal leaves a dangling\nentry behind that mt7915_mac_twt_sched_list_add() later walks."
          }
        ],
        "id": "CVE-2026-90357",
        "lastModified": "2026-10-19T09:19:29.680",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:34.590",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/16a04441eab0dcd4d7126a6f66b370adbf28f96d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6bce0f1280c94af8314f895f404629da09f0788c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/beaa42b875965dbc3e80e46970e0bfa60a94c2db"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c09d1b15ed2dc49060303b16a296b7b8b7794cbe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cabe239e95b4eebf5b6c3654087b66ff9425bc7b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:41:24+00:00",
      "cve": "CVE-2026-90357",
      "id": "CVE-2026-90357",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_not_affected": "203",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90357.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.