Vulnerability-Lookup

FKIE_CVE-2026-90382

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a corrupted frame can report a length larger than the received buffer. The bounds check correctly discards such frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage frame taints the kernel, and panics it on the first such frame when panic_on_warn is set. Drop the WARN and discard the frame silently, matching what commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx status and rx path") did for the neighboring rx and tx status paths. Observed immediately on rx with an MT7612U in fcsfail monitor mode on a busy channel.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "61b1f6d92249bc34580ff19de7c69c805f82adca",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "d55e7aede542c4c76ead82d37d0c112f21eb2ac2",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "b6e7958602bd1acdb8ae92703b6689a28bcc9bc0",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "2d31e332c13b1db7745a7bd9cf74bc105524bcac",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "17d6b89e09eac2d90272fceeba3644e92212e02f",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "6def491fe9c4e83aa8cba62d74e9d4ab751ee967",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "81497634d9f872fd3e8b03aada55574afff6f174",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt76x02: do not WARN on invalid rx descriptor length\n\nThe MPDU length in the rx descriptor comes from the hardware. In\nmonitor mode with the fcsfail filter enabled, the hardware passes up\ncorrupted frames, and a corrupted frame can report a length larger\nthan the received buffer. The bounds check correctly discards such\nframes, but its WARN_ON_ONCE wrapper means any over-the-air garbage\nframe taints the kernel, and panics it on the first such frame when\npanic_on_warn is set.\n\nDrop the WARN and discard the frame silently, matching what\ncommit c2d4c8723dbf (\"mt76x2: remove some harmless WARN_ONs in tx\nstatus and rx path\") did for the neighboring rx and tx status paths.\n\nObserved immediately on rx with an MT7612U in fcsfail monitor mode\non a busy channel."
    }
  ],
  "id": "CVE-2026-90382",
  "lastModified": "2026-09-17T17:17:37.503",
  "metrics": {},
  "published": "2026-09-17T17:17:37.503",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90382 (GCVE-0-2026-90382)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-17 16:09

Title

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

Summary

Severity

No CVSS data available.

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/61b1f6d92249bc345…
https://git.kernel.org/stable/c/c65bbfc730df9ebf0…
https://git.kernel.org/stable/c/d55e7aede542c4c76…
https://git.kernel.org/stable/c/b6e7958602bd1acdb…
https://git.kernel.org/stable/c/2d31e332c13b1db77…
https://git.kernel.org/stable/c/17d6b89e09eac2d90…
https://git.kernel.org/stable/c/6def491fe9c4e83aa…
https://git.kernel.org/stable/c/81497634d9f872fd3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 61b1f6d92249bc34580ff19de7c69c805f82adca (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < d55e7aede542c4c76ead82d37d0c112f21eb2ac2 (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < b6e7958602bd1acdb8ae92703b6689a28bcc9bc0 (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 2d31e332c13b1db7745a7bd9cf74bc105524bcac (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 17d6b89e09eac2d90272fceeba3644e92212e02f (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 6def491fe9c4e83aa8cba62d74e9d4ab751ee967 (git) Affected: 7bc04215a66b60e198aecaee8418f6d79fa19faa , < 81497634d9f872fd3e8b03aada55574afff6f174 (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "61b1f6d92249bc34580ff19de7c69c805f82adca",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "d55e7aede542c4c76ead82d37d0c112f21eb2ac2",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "b6e7958602bd1acdb8ae92703b6689a28bcc9bc0",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "2d31e332c13b1db7745a7bd9cf74bc105524bcac",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "17d6b89e09eac2d90272fceeba3644e92212e02f",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "6def491fe9c4e83aa8cba62d74e9d4ab751ee967",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            },
            {
              "lessThan": "81497634d9f872fd3e8b03aada55574afff6f174",
              "status": "affected",
              "version": "7bc04215a66b60e198aecaee8418f6d79fa19faa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76x02_mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt76x02: do not WARN on invalid rx descriptor length\n\nThe MPDU length in the rx descriptor comes from the hardware. In\nmonitor mode with the fcsfail filter enabled, the hardware passes up\ncorrupted frames, and a corrupted frame can report a length larger\nthan the received buffer. The bounds check correctly discards such\nframes, but its WARN_ON_ONCE wrapper means any over-the-air garbage\nframe taints the kernel, and panics it on the first such frame when\npanic_on_warn is set.\n\nDrop the WARN and discard the frame silently, matching what\ncommit c2d4c8723dbf (\"mt76x2: remove some harmless WARN_ONs in tx\nstatus and rx path\") did for the neighboring rx and tx status paths.\n\nObserved immediately on rx with an MT7612U in fcsfail monitor mode\non a busy channel."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:09:19.247Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca"
        },
        {
          "url": "https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac"
        },
        {
          "url": "https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967"
        },
        {
          "url": "https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174"
        }
      ],
      "title": "wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90382",
    "datePublished": "2026-09-17T16:09:19.247Z",
    "dateReserved": "2026-09-11T19:38:34.809Z",
    "dateUpdated": "2026-09-17T16:09:19.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-90382

CVE-2026-90382 (GCVE-0-2026-90382)

Tags

Sightings

Nomenclature

Related by attack behaviour