FKIE_CVE-2026-90370

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config The response TLV loop advanced by tlv->len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during device probe. The u32 payload was also read without bounds checking. Reject a short fixed field, stop on a TLV whose length underruns the header or overruns the skb.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3106f62809d45c1e6aadfad1f4d7c3f74cd53a96
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/39aa6b853b6d69dd1fee3507efdb3c277b7c53e6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/44af52467e72094351a362bf69effd52f1d9c186
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/93eaddfdd35aa6bfe570c087db4e97fb9d8a791a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d0bb2189ade617e624f3c8f444ebb05f59bb2524
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3106f62809d45c1e6aadfad1f4d7c3f74cd53a96",
              "status": "affected",
              "version": "5d33053be609abfcfa9f5ca75d5554f2109aa40b",
              "versionType": "git"
            },
            {
              "lessThan": "39aa6b853b6d69dd1fee3507efdb3c277b7c53e6",
              "status": "affected",
              "version": "5d33053be609abfcfa9f5ca75d5554f2109aa40b",
              "versionType": "git"
            },
            {
              "lessThan": "d0bb2189ade617e624f3c8f444ebb05f59bb2524",
              "status": "affected",
              "version": "5d33053be609abfcfa9f5ca75d5554f2109aa40b",
              "versionType": "git"
            },
            {
              "lessThan": "93eaddfdd35aa6bfe570c087db4e97fb9d8a791a",
              "status": "affected",
              "version": "5d33053be609abfcfa9f5ca75d5554f2109aa40b",
              "versionType": "git"
            },
            {
              "lessThan": "44af52467e72094351a362bf69effd52f1d9c186",
              "status": "affected",
              "version": "5d33053be609abfcfa9f5ca75d5554f2109aa40b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config\n\nThe response TLV loop advanced by tlv-\u003elen without a minimum, so a\ntheoretical firmware response containing a zero-length TLV could spin\nforever, hanging the CPU during device probe.\nThe u32 payload was also read without bounds checking.\nReject a short fixed field, stop on a TLV whose length underruns the\nheader or overruns the skb."
    }
  ],
  "id": "CVE-2026-90370",
  "lastModified": "2026-09-17T17:17:36.147",
  "metrics": {},
  "published": "2026-09-17T17:17:36.147",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3106f62809d45c1e6aadfad1f4d7c3f74cd53a96"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/39aa6b853b6d69dd1fee3507efdb3c277b7c53e6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/44af52467e72094351a362bf69effd52f1d9c186"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/93eaddfdd35aa6bfe570c087db4e97fb9d8a791a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d0bb2189ade617e624f3c8f444ebb05f59bb2524"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.