CVE-2026-90372 (GCVE-0-2026-90372)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:54
VLAI
Title
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss If a peer's VHT/HE MCS map has no supported spatial stream (all fields 0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255), which was then written into the firmware sta_rec_bf beamforming fields. Clamp the result to 0.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < 2801477c36a19be4f549fe60e54995f03b0ea7b9 (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < 38f4d6323bcd65e41a691432eddabd2b03acdeee (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < 25f753f7f620955a8a51e63e445d8b9076c51396 (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < e63c6291ecddf94769ab91f9d8cdb6ca939f7fc6 (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < 85bd46ab7674b6d357f9a14791352c65fb09eee9 (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < 6ce78d04c7ea4b66838941b5a4232dd1ee0e2cc7 (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < ecfd1a07e78c31d81322fb2d81dc468081cc3004 (git)
Affected: 89029a85482cbcf68026a89fc974e8f6898d6b37 , < 4a2f4be532e3ea4e2b536e411793a05aaa51af25 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2801477c36a19be4f549fe60e54995f03b0ea7b9",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "38f4d6323bcd65e41a691432eddabd2b03acdeee",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "25f753f7f620955a8a51e63e445d8b9076c51396",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "e63c6291ecddf94769ab91f9d8cdb6ca939f7fc6",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "85bd46ab7674b6d357f9a14791352c65fb09eee9",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "6ce78d04c7ea4b66838941b5a4232dd1ee0e2cc7",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "ecfd1a07e78c31d81322fb2d81dc468081cc3004",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            },
            {
              "lessThan": "4a2f4be532e3ea4e2b536e411793a05aaa51af25",
              "status": "affected",
              "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss\n\nIf a peer\u0027s VHT/HE MCS map has no supported spatial stream (all fields\n0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255),\nwhich was then written into the firmware sta_rec_bf beamforming fields.\nClamp the result to 0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A nearby 802.11 peer supplies the malformed MCS map in the HE Capabilities MCS NSS field of an Association Request. hostapd\u0027s NL80211_CMD_NEW_STATION reaches ieee80211_add_station()\u2192sta_link_apply_parameters(), which copies he_mcs_nss_supp; mt76_sta_state(AUTH\u2192ASSOC) then calls mt7915_mcu_get_sta_nss() on that map. WiFi radio range is Adjacent.\nAC:L - The attacker sets every 2-bit NSS field in HE rx_mcs_80 or rx_mcs_160 to 0x3. mt7915_mcu_get_sta_nss() then leaves its nss=8..1 loop with nss==0 and returns (u8)-1 (255) on every association. mac80211 does not reject an all-0x3 HE MCS map (unlike the 0xFFFF VHT check in ieee80211_vht_cap_ie_to_sta_vht_cap()). No race is involved.\nPR:N - mt7915_mac_sta_event(MT76_STA_EVENT_ASSOC) runs from sta_info_move_state(IEEE80211_STA_ASSOC) when hostapd\u0027s NL80211_CMD_NEW_STATION sets ASSOCIATED, before AUTHORIZED (the WPA 4-way handshake). 802.11 Open System authentication does not require a PSK or SAE credential on this path.\nUI:N - The attacker transmits the Association Request. ieee80211_add_station() and mt7915_mcu_add_sta() run in the AP kernel with no operator action on the victim device.\nS:U - The underflowed NSS is stored in the kernel sta_rec_bf TLV and sent to the on-device mt7915 MCU via MCU_EXT_CMD(STA_REC_UPDATE). Impact stays in the same kernel/device authority; this is not a VM, IOMMU, or sandbox escape.\nC:N - mt7915_mcu_get_sta_nss() only derives a u8 from the peer MCS map. That 255 is stored in sta_rec_bf.ncol_gt_bw80 or ibf_ncol; ncol used to index matrix[4][4] is min()\u0027d with nrow, so there is no kernel OOB read and nothing is returned over the air.\nI:L - mt7915_mcu_sta_bfer_he() writes the underflowed nss_mcs (255) directly to sta_rec_bf.ncol_gt_bw80 on 160 MHz, and the implicit-VHT path writes it to ibf_ncol, then mt7915_mcu_add_sta() sends that TLV to firmware. That is a limited corruption of the chip beamforming profile, not an arbitrary kernel write.\nA:H - ncol_gt_bw80 and ibf_ncol are NSS counts the mt7915 MCU uses as beamforming dimensions. 255 is far outside the 0\u20133 range implied by the driver\u0027s matrix[4][4], so the firmware can hang or crash and take the radio down, and the peer can retrigger it on every association."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:54.603Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2801477c36a19be4f549fe60e54995f03b0ea7b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/38f4d6323bcd65e41a691432eddabd2b03acdeee"
        },
        {
          "url": "https://git.kernel.org/stable/c/25f753f7f620955a8a51e63e445d8b9076c51396"
        },
        {
          "url": "https://git.kernel.org/stable/c/e63c6291ecddf94769ab91f9d8cdb6ca939f7fc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/85bd46ab7674b6d357f9a14791352c65fb09eee9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ce78d04c7ea4b66838941b5a4232dd1ee0e2cc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecfd1a07e78c31d81322fb2d81dc468081cc3004"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a2f4be532e3ea4e2b536e411793a05aaa51af25"
        }
      ],
      "title": "wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90372",
    "datePublished": "2026-09-17T16:09:12.733Z",
    "dateReserved": "2026-09-11T19:38:34.808Z",
    "dateUpdated": "2026-09-18T17:54:54.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90372",
      "date": "2026-09-25",
      "epss": "0.00408",
      "percentile": "0.32368"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2801477c36a19be4f549fe60e54995f03b0ea7b9",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "38f4d6323bcd65e41a691432eddabd2b03acdeee",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25f753f7f620955a8a51e63e445d8b9076c51396",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e63c6291ecddf94769ab91f9d8cdb6ca939f7fc6",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85bd46ab7674b6d357f9a14791352c65fb09eee9",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6ce78d04c7ea4b66838941b5a4232dd1ee0e2cc7",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ecfd1a07e78c31d81322fb2d81dc468081cc3004",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4a2f4be532e3ea4e2b536e411793a05aaa51af25",
                    "status": "affected",
                    "version": "89029a85482cbcf68026a89fc974e8f6898d6b37",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss\n\nIf a peer\u0027s VHT/HE MCS map has no supported spatial stream (all fields\n0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255),\nwhich was then written into the firmware sta_rec_bf beamforming fields.\nClamp the result to 0."
          }
        ],
        "id": "CVE-2026-90372",
        "lastModified": "2026-09-18T18:17:55.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:36.363",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25f753f7f620955a8a51e63e445d8b9076c51396"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2801477c36a19be4f549fe60e54995f03b0ea7b9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/38f4d6323bcd65e41a691432eddabd2b03acdeee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4a2f4be532e3ea4e2b536e411793a05aaa51af25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6ce78d04c7ea4b66838941b5a4232dd1ee0e2cc7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/85bd46ab7674b6d357f9a14791352c65fb09eee9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e63c6291ecddf94769ab91f9d8cdb6ca939f7fc6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ecfd1a07e78c31d81322fb2d81dc468081cc3004"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.