CVE-2026-90349 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
When mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[],
mvif->mt76.link[] and sta->link[], all of which hold
IEEE80211_MLD_MAX_NUM_LINKS (15) entries.
Clamp the primary link id to the default link before using it, and use the clamped value for the link_sta fallback as well.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel within the mt7996 Wi-Fi driver represents a critical out-of-bounds array access issue that arises from improper handling of unspecified link identifiers during transmission operations. This flaw is located specifically within the mt7996_tx function, which serves as the primary transmit path for devices utilizing this chipset architecture. The root cause lies in how the driver manages station and virtual interface configurations when mac80211 does not explicitly specify a link identifier. In such scenarios, the code defaults to substituting the value with IEEE80211_LINK_UNSPECIFIED, which is defined as 0xf or fifteen in decimal notation. While this default behavior aims to provide a fallback mechanism, it fails to account for the state of the connection before any links have been successfully established by the system.
The technical severity of this flaw stems from the fact that the value IEEE80211_LINK_UNSPECIFIED is used directly as an index into several critical data structures without prior validation or clamping. Specifically, it indexes vif->link_conf[], mvif->mt76.link[], and sta->link[]. These arrays are statically sized to hold exactly IEEE80211_MLD_MAX_NUM_LINKS entries, which equals fifteen elements indexed from zero to fourteen. By using the value 0xf as an index, the driver attempts to access the sixteenth element of these arrays, resulting in a buffer over-read or write depending on the specific operation context. This constitutes a classic out-of-bounds memory access vulnerability where the boundary condition is violated because the maximum valid index is strictly less than the unspecified link identifier value.
From an operational perspective, this vulnerability can lead to severe consequences including kernel panics, system crashes, and potential privilege escalation if exploited by malicious actors capable of triggering specific transmission states before link establishment completes. The lack of bounds checking allows for memory corruption that may compromise the integrity of adjacent data structures within the same memory page or cause segmentation faults when accessing unmapped pages. In network environments where high throughput is required, this race condition between link initialization and packet transmission can be triggered frequently, leading to instability in Wi-Fi connectivity and potential denial-of-service conditions for users connected via mt7996-based hardware.
This issue aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write depending on whether the operation involves reading configuration data or writing transmission parameters, as well as CWE-134 Use of Externally-Controlled Format String if format strings are involved in logging related to these structures. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with Tactic TA0005 Defense Evasion through exploitation of memory corruption and potentially TA0004 Privilege Escalation if the kernel crash leads to exploitable state changes or information disclosure that aids in further attacks. The attack vector is primarily local but can be triggered remotely by sending specially crafted packets that force the driver into a state where links are unspecified during transmission attempts.
To mitigate this vulnerability, developers must implement strict bounds checking before accessing any link-specific arrays using identifiers derived from mac80211 subsystems. The recommended fix involves clamping the primary link identifier to ensure it remains within the valid range of zero to IEEE80211_MLD_MAX_NUM_LINKS minus one prior to its use as an array index. This ensures that even if the system defaults to the unspecified value, it is safely mapped to a default or first available link rather than causing memory violations. Additionally, applying patches that enforce these constraints during both station and virtual interface configuration phases will prevent exploitation across all transmission paths. System administrators should ensure their kernels are updated with vendor-provided fixes that address this specific logic error in the mt7996 driver implementation to maintain system stability and security posture against potential remote or local exploits targeting Wi-Fi subsystems.