CVE-2026-90381 (GCVE-0-2026-90381)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-10-19 09:02
VLAI
Title
wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each struct ieee80211_vif_chanctx_switch. Rework mt76_switch_vif_chanctx() to properly handle this scenario.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82334623af0cd2154633cdb007719a321048fafc , < 7a1b971b799eae8a957acb90d8100576df889644 (git)
Affected: 82334623af0cd2154633cdb007719a321048fafc , < 063169a2755abdcbe7698d98360336abb6bef414 (git)
Affected: 82334623af0cd2154633cdb007719a321048fafc , < 70869cc429fffc77de51e7777c0ecb651e8fca07 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a1b971b799eae8a957acb90d8100576df889644",
              "status": "affected",
              "version": "82334623af0cd2154633cdb007719a321048fafc",
              "versionType": "git"
            },
            {
              "lessThan": "063169a2755abdcbe7698d98360336abb6bef414",
              "status": "affected",
              "version": "82334623af0cd2154633cdb007719a321048fafc",
              "versionType": "git"
            },
            {
              "lessThan": "70869cc429fffc77de51e7777c0ecb651e8fca07",
              "status": "affected",
              "version": "82334623af0cd2154633cdb007719a321048fafc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()\n\nWhen performing channel switches on different radios within a short\ntimeframe, channel contexts with different bands can be carried for\neach struct ieee80211_vif_chanctx_switch.\n\nRework mt76_switch_vif_chanctx() to properly handle this scenario."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - CSA IEs in a received Beacon (ieee80211_rx_mgmt_beacon \u2192 ieee80211_sta_process_chanswitch \u2192 ieee80211_link_reserve_chanctx) or Channel Switch action frame (ieee80211_sta_rx_queued_mgmt) make ieee80211_chsw_switch_vifs call mt76_switch_vif_chanctx with one ieee80211_vif_chanctx_switch per radio; those 802.11 frames are radio-range, not a routable IP protocol.\nAC:L - ieee80211_vif_use_reserved_switch returns -EAGAIN until every in-place reservation is reserved_ready, then ieee80211_chsw_switch_vifs batches them into one CHANCTX_SWMODE_SWAP_CONTEXTS call; an AP/MLD that puts CSA IEs on two mt7996 bands with matching counts makes both ready in order with no victim-only race.\nPR:N - ieee80211_rx_mgmt_beacon only needs ieee80211_rx_our_beacon() BSSID match on an associated STA, and mt7996 sets CHANCTX_STA_CSA so this path is used; beacons are unauthenticated, so the AP or a radio-range BSSID spoof needs no Linux capability or account.\nUI:N - An already-associated station runs ieee80211_csa_switch_work \u2192 ieee80211_link_use_reserved_context when the CSA count elapses and automatically enters mt76_switch_vif_chanctx; no extra click, reconnect, or mount is required at trigger time.\nS:U - Aliased mlink-\u003ectx, the leftover phy-\u003echanctx on non-first radios, and any resulting host-kernel heap UAF stay inside this machine\u2019s mt76/mac80211; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The pre-fix function set every mlink-\u003ectx to vifs[0].new_ctx. After that first ieee80211_chanctx is kfree_rcu\u2019d (ieee80211_free_chanctx when the first vif/link unassigns while others remain), mt76_vif_link_phy() still does mlink-\u003ectx-\u003edrv_priv and reads ctx-\u003ephy from the freed object, a kernel info-leak UAF.\nI:H - The same dangling mlink-\u003ectx makes mt76_vif_link_phy() return ctx-\u003ephy from reallocatable freed ieee80211_chanctx memory; callers such as mt7996_link_info_changed then issue MCU updates (mt7996_mcu_add_bss_info and similar) through that forged mt76_phy pointer, a kernel write/control-flow primitive.\nA:H - mt76_vif_link_phy() on the stale mlink-\u003ectx oopses after the aliased chanctx is freed; the pre-fix path also skipped mt76_phy_update_channel for every radio but vifs[0], leaving that PHY\u2019s phy-\u003echanctx pointing at the old ctx that ieee80211_vif_use_reserved_switch kfree_rcu\u2019s, taking the radio down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:02:40.869Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a1b971b799eae8a957acb90d8100576df889644"
        },
        {
          "url": "https://git.kernel.org/stable/c/063169a2755abdcbe7698d98360336abb6bef414"
        },
        {
          "url": "https://git.kernel.org/stable/c/70869cc429fffc77de51e7777c0ecb651e8fca07"
        }
      ],
      "title": "wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90381",
    "datePublished": "2026-09-17T16:09:18.603Z",
    "dateReserved": "2026-09-11T19:38:34.809Z",
    "dateUpdated": "2026-10-19T09:02:40.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90381",
      "date": "2026-11-14",
      "epss": "0.00375",
      "percentile": "0.31986"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-22T01:11:46.000Z",
      "cve": "CVE-2026-90381",
      "id": "msrc_CVE-2026-90381",
      "initial_release_date": "2026-10-22T01:11:46.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90381.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/channel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7a1b971b799eae8a957acb90d8100576df889644",
                    "status": "affected",
                    "version": "82334623af0cd2154633cdb007719a321048fafc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "063169a2755abdcbe7698d98360336abb6bef414",
                    "status": "affected",
                    "version": "82334623af0cd2154633cdb007719a321048fafc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "70869cc429fffc77de51e7777c0ecb651e8fca07",
                    "status": "affected",
                    "version": "82334623af0cd2154633cdb007719a321048fafc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/channel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()\n\nWhen performing channel switches on different radios within a short\ntimeframe, channel contexts with different bands can be carried for\neach struct ieee80211_vif_chanctx_switch.\n\nRework mt76_switch_vif_chanctx() to properly handle this scenario."
          }
        ],
        "id": "CVE-2026-90381",
        "lastModified": "2026-10-19T09:19:32.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:37.397",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/063169a2755abdcbe7698d98360336abb6bef414"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/70869cc429fffc77de51e7777c0ecb651e8fca07"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a1b971b799eae8a957acb90d8100576df889644"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-07T10:37:33+00:00",
      "cve": "CVE-2026-90381",
      "id": "CVE-2026-90381",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "110",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90381.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.