CVE-2026-90366
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic(). Reserve room for both countdown TLVs.
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedSep 17, 2026
First seenSep 17, 2026
How to fix
Update
- Linux Linux1d348f96623ec20d700af7d4dfc00a74da6238ac, bc1d694a1ffe0062c3adf0db1d64ad54454398ec, 45d8896e4cffffb2c6554ccbec6efe7a0d53166f, 1a51aff0e048dc5b8252d65808b79939c942d6ec, 50c66bab321140c49aa2ed779a3ec9d2f085b458 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 1d348f96623ec20d700af7d4dfc00a74da6238ac, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < bc1d694a1ffe0062c3adf0db1d64ad54454398ec, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 45d8896e4cffffb2c6554ccbec6efe7a0d53166f, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 1a51aff0e048dc5b8252d65808b79939c942d6ec, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 50c66bab321140c49aa2ed779a3ec9d2f085b458, 6.2 | 1d348f96623ec20d700af7d4dfc00a74da6238ac, bc1d694a1ffe0062c3adf0db1d64ad54454398ec, 45d8896e4cffffb2c6554ccbec6efe7a0d53166f, 1a51aff0e048dc5b8252d65808b79939c942d6ec, 50c66bab321140c49aa2ed779a3ec9d2f085b458 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.