CVE-2026-90357
High
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Linux
PublishedSep 17, 2026
First seenSep 17, 2026
How to fix
Update
- Linux Linuxc09d1b15ed2dc49060303b16a296b7b8b7794cbe, 1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7, cabe239e95b4eebf5b6c3654087b66ff9425bc7b, 6bce0f1280c94af8314f895f404629da09f0788c, beaa42b875965dbc3e80e46970e0bfa60a94c2db, 16a04441eab0dcd4d7126a6f66b370adbf28f96d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3782b69d03e714b8ff98b84c7426d8cef0e64d7c ≤ v < c09d1b15ed2dc49060303b16a296b7b8b7794cbe, 3782b69d03e714b8ff98b84c7426d8cef0e64d7c ≤ v < 1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7, 3782b69d03e714b8ff98b84c7426d8cef0e64d7c ≤ v < cabe239e95b4eebf5b6c3654087b66ff9425bc7b, 3782b69d03e714b8ff98b84c7426d8cef0e64d7c ≤ v < 6bce0f1280c94af8314f895f404629da09f0788c, 3782b69d03e714b8ff98b84c7426d8cef0e64d7c ≤ v < beaa42b875965dbc3e80e46970e0bfa60a94c2db, 3782b69d03e714b8ff98b84c7426d8cef0e64d7c ≤ v < 16a04441eab0dcd4d7126a6f66b370adbf28f96d, 5.16 | c09d1b15ed2dc49060303b16a296b7b8b7794cbe, 1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7, cabe239e95b4eebf5b6c3654087b66ff9425bc7b, 6bce0f1280c94af8314f895f404629da09f0788c, beaa42b875965dbc3e80e46970e0bfa60a94c2db, 16a04441eab0dcd4d7126a6f66b370adbf28f96d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.