CVE-2026-90349
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx() When mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[], mvif->mt76.link[] and sta->link[], all of which hold IEEE80211_MLD_MAX_NUM_LINKS (15) entries. Clamp the primary link id to the default link before using it, and use the clamped value for the link_sta fallback as well.
How to fix
- Linux Linux637bb99cc766a858d744905e46638459ca128b6c, aff81505a84d27f83b4db8e039e813930cb23c2c, 4330a0ef9f75a54fde3548432a9a698f06bab635 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1609b014aa29f9a2bf3aaa93f71de4a06725845e ≤ v < 637bb99cc766a858d744905e46638459ca128b6c, 1609b014aa29f9a2bf3aaa93f71de4a06725845e ≤ v < aff81505a84d27f83b4db8e039e813930cb23c2c, 1609b014aa29f9a2bf3aaa93f71de4a06725845e ≤ v < 4330a0ef9f75a54fde3548432a9a698f06bab635, 6.18 | 637bb99cc766a858d744905e46638459ca128b6c, aff81505a84d27f83b4db8e039e813930cb23c2c, 4330a0ef9f75a54fde3548432a9a698f06bab635 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.