CVE-2026-90357 (GCVE-0-2026-90357)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:54
VLAI
Title
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < c09d1b15ed2dc49060303b16a296b7b8b7794cbe (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < 1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7 (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < cabe239e95b4eebf5b6c3654087b66ff9425bc7b (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < 6bce0f1280c94af8314f895f404629da09f0788c (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < beaa42b875965dbc3e80e46970e0bfa60a94c2db (git)
Affected: 3782b69d03e714b8ff98b84c7426d8cef0e64d7c , < 16a04441eab0dcd4d7126a6f66b370adbf28f96d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c09d1b15ed2dc49060303b16a296b7b8b7794cbe",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "cabe239e95b4eebf5b6c3654087b66ff9425bc7b",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "6bce0f1280c94af8314f895f404629da09f0788c",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "beaa42b875965dbc3e80e46970e0bfa60a94c2db",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            },
            {
              "lessThan": "16a04441eab0dcd4d7126a6f66b370adbf28f96d",
              "status": "affected",
              "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement\n\nThe flow is added to dev-\u003etwt_list before sending the agreement to the\nfirmware, but the error path leaves it linked while flowid_mask is\nnever set. The flow slot can then be reused and memset while still on\nthe list, corrupting twt_list, and station removal leaves a dangling\nentry behind that mt7915_mac_twt_sched_list_add() later walks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - WLAN_S1G_TWT_SETUP action frames carry the TWT element into ieee80211_rx_h_action \u2192 ieee80211_process_rx_twt_action \u2192 ieee80211_s1g_rx_twt_setup \u2192 drv_add_twt_setup \u2192 mt7915_mac_add_twt_setup; the triggering bytes arrive over 802.11 radio on the AP\u2019s LAN segment, so the vector is Adjacent.\nAC:L - After mt7915_mcu_twt_agrt_update(..., MCU_TWT_AGRT_ADD) fails, a second TWT setup from the same STA does memset/INIT_LIST_HEAD on the still-linked msta-\u003etwt.flow[] slot because flowid_mask was never set. The attacker induces that ADD failure (MCU timeout or mt76_dma_tx_queue_skb_raw queue-full) with their own traffic, then retries or deauths; not a victim-only race.\nPR:N - ieee80211_process_rx_twt_action only requires rx-\u003esta on an AP with twt_responder; WLAN_CATEGORY_S1G TWT frames are not robust management frames, so MFP does not gate them. No Linux account or capability is needed: associating as a client to an open or guest mt7915 AP is enough to send the TWT setup.\nUI:N - The attacker sends the TWT Setup action frame and the follow-up retry or deauth; ieee80211_iface_work \u2192 ieee80211_s1g_rx_twt_action runs with no local user step. An already-running AP with twt_responder is standing configuration, not victim interaction during the attack.\nS:U - mt7915_mac_add_twt_setup corrupts the host kernel\u2019s dev-\u003etwt_list and the mt7915_twt_flow embedded in sta-\u003edrv_priv; impact stays inside that kernel security authority and does not cross a VM, IOMMU, or guest-to-host boundary.\nC:H - On DISASSOC, mt7915_mac_twt_teardown_flow returns immediately when flowid_mask is unset, then sta_info_free kfree\u2019s the sta while the node remains on twt_list. A later mt7915_mac_twt_sched_list_add walk reads the freed mt7915_twt_flow, a use-after-free of attacker-reallocatable sta slab.\nI:H - The retry path memset/INIT_LIST_HEAD of a still-linked flow, and list_add in mt7915_mac_twt_sched_list_add, write next/prev through corrupted or freed list nodes, yielding a kernel write primitive from list corruption and the DISASSOC use-after-free.\nA:H - mt7915_mac_twt_sched_list_add walking the corrupted or dangling twt_list oopses on a freed mt7915_twt_flow or spins forever on a self-linked node after INIT_LIST_HEAD, hanging or panicking the AP kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:49.445Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c09d1b15ed2dc49060303b16a296b7b8b7794cbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cabe239e95b4eebf5b6c3654087b66ff9425bc7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bce0f1280c94af8314f895f404629da09f0788c"
        },
        {
          "url": "https://git.kernel.org/stable/c/beaa42b875965dbc3e80e46970e0bfa60a94c2db"
        },
        {
          "url": "https://git.kernel.org/stable/c/16a04441eab0dcd4d7126a6f66b370adbf28f96d"
        }
      ],
      "title": "wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90357",
    "datePublished": "2026-09-17T16:09:02.873Z",
    "dateReserved": "2026-09-11T19:38:34.806Z",
    "dateUpdated": "2026-09-18T17:54:49.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90357",
      "date": "2026-09-25",
      "epss": "0.00403",
      "percentile": "0.31787"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c09d1b15ed2dc49060303b16a296b7b8b7794cbe",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cabe239e95b4eebf5b6c3654087b66ff9425bc7b",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6bce0f1280c94af8314f895f404629da09f0788c",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "beaa42b875965dbc3e80e46970e0bfa60a94c2db",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16a04441eab0dcd4d7126a6f66b370adbf28f96d",
                    "status": "affected",
                    "version": "3782b69d03e714b8ff98b84c7426d8cef0e64d7c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement\n\nThe flow is added to dev-\u003etwt_list before sending the agreement to the\nfirmware, but the error path leaves it linked while flowid_mask is\nnever set. The flow slot can then be reused and memset while still on\nthe list, corrupting twt_list, and station removal leaves a dangling\nentry behind that mt7915_mac_twt_sched_list_add() later walks."
          }
        ],
        "id": "CVE-2026-90357",
        "lastModified": "2026-09-18T18:17:55.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:34.590",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/16a04441eab0dcd4d7126a6f66b370adbf28f96d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6bce0f1280c94af8314f895f404629da09f0788c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/beaa42b875965dbc3e80e46970e0bfa60a94c2db"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c09d1b15ed2dc49060303b16a296b7b8b7794cbe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cabe239e95b4eebf5b6c3654087b66ff9425bc7b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.