CVE-2026-90353 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
After mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw. Unregister the ext PHY (thermal + phy + hw) first and skip the redundant free.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel within the MediaTek MT7915 Wi-Fi driver represents a critical use-after-free condition that occurs during the device initialization sequence, specifically when handling errors related to external physical layer registration. This flaw is rooted in an improper cleanup logic path where the driver fails to correctly manage the lifecycle of hardware resources associated with secondary or extended PHYs. The issue manifests after the function mt7915_register_ext_phy() successfully registers an additional wireless interface but before all subsequent initialization steps for that specific hardware component are completed. When a failure occurs in downstream functions such as mt7915_init_debugfs() or mt7915_coredump_register(), the error handling routine attempts to unwind the state by calling free_phy2, which subsequently invokes ieee80211_free_hw(). This action is problematic because it frees the hardware structure while it remains registered with the mac80211 subsystem. The root cause lies in the asymmetry of the registration and unregistration processes; specifically, mt76_unregister_device() only handles the main hardware device and does not account for the extended PHY components that were previously added to the system.
From a technical perspective, this vulnerability aligns with CWE-416, Use After Free, where memory is accessed after it has been freed, leading to undefined behavior. In the context of kernel-space drivers, such an error can result in severe stability issues including kernel panics, data corruption, or potential privilege escalation if an attacker can influence the allocation patterns that reuse the freed memory address. The operational impact includes system instability during device setup phases, particularly when debugfs initialization fails due to permission errors or missing filesystem mounts, or when coredump registration encounters restrictions. These are relatively common failure modes in Linux kernel development, making this vulnerability exploitable under specific configuration conditions without requiring external network interaction. However, the primary risk is local denial of service through system crash rather than remote code execution, although memory corruption could theoretically be leveraged for further exploitation depending on the surrounding heap layout and kernel hardening measures present at runtime.
The mitigation strategy implemented in this patch addresses the flaw by restructuring the error handling path to ensure proper resource deallocation order. The fix mandates that when an initialization failure occurs after external PHY registration, the driver must first explicitly unregister all components associated with the extended PHY, including thermal management interfaces, physical layer structures, and hardware devices, before proceeding to free them. This ensures that mac80211 is properly notified of the device removal, preventing dangling pointers and invalid memory accesses. Additionally, the patch skips redundant freeing operations that would otherwise attempt to release already-unregistered or partially cleaned-up resources. This approach aligns with best practices for kernel driver development as outlined in various ATT&CK techniques related to system discovery and defense evasion, where maintaining clean state transitions is crucial for preventing exploitation vectors. Administrators should ensure their systems are updated with the patched version of the Linux kernel containing this fix to maintain stability during Wi-Fi adapter initialization processes.