CVE-2026-90355 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: clear stale link state on full reset
After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996_vif_link_add() short-circuits when the link_id is still marked in mvif->valid_links, a state introduced for postponing link teardown to interface removal. The reset path frees the link structures without clearing those bits, so the replayed setup never re-creates dev_info/bss_info/STA records in the restarted firmware and never re-registers the link wcid, leaving the device inoperative.
The reset path also leaks every allocated MLD index: per-link indices and the per-vif group/remap indices are re-allocated from scratch during reconfig, but the old bits stay set in the masks, so repeated full resets exhaust the index space.
Clear valid_links in the reset vif iterator and reset the MLD index masks alongside the existing omac_mask clearing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Linux kernel's mt7996 Wi-Fi driver stems from improper state management during hardware reset operations, specifically affecting multi-link operation (MLO) capabilities introduced in recent wireless standards. When a full chip reset is triggered, the mac80211 subsystem initiates a reconfiguration process that replays interface, link, and channel context setups to restore network connectivity. However, the mt7996 driver's implementation of this recovery path contains critical logic flaws regarding how it tracks valid links and manages index allocations. The function responsible for adding or updating virtual interface links, mt7996_vif_link_add(), employs a short-circuit mechanism that checks if the link identifier is already present in the mvif->valid_links bitmask. This bitmask is designed to postpone link teardown until interface removal, but during a reset scenario, this logic prevents necessary re-initialization steps from executing because it incorrectly assumes the state remains valid despite the hardware being reset.
This failure to clear stale state results in two distinct operational impacts that degrade or completely disable network functionality. First, when the short-circuit condition triggers due to uncleared bits in the valid_links mask, the driver fails to re-create essential device information, basic service set (BSS) information, and station association records within the restarted firmware. Furthermore, it neglects to re-register the link-specific wireless client identifier (WCID). Consequently, the Wi-Fi device becomes effectively inoperative because the firmware lacks the necessary context to handle traffic or maintain associations for any active links. This represents a denial of service condition where normal network operations are halted until a system reboot or driver reload occurs, as the software state is out of sync with the hardware's reset baseline.
Secondly, the vulnerability introduces a resource leak that can lead to eventual system instability through exhaustion of available resources. During each reconfiguration cycle following a reset, new multi-link device (MLD) indices are allocated from scratch for per-link operations and per-virtual interface group mappings. However, because the driver does not clear the corresponding bits in the MLD index masks during the reset path, these old allocations remain marked as active even though they have been freed or invalidated by the hardware reset. Over time, repeated full resets will progressively exhaust the limited pool of available indices. Once this space is depleted, new connections cannot be established, and further link operations may fail unpredictably, leading to a gradual degradation of network performance culminating in total connectivity loss without requiring immediate user intervention beyond triggering multiple resets.
From a security taxonomy perspective, this issue aligns with CWE-401, which describes the failure to release memory or other resources after they are no longer needed, specifically manifesting here as resource exhaustion through improper state cleanup. Additionally, the lack of proper synchronization between hardware reset events and software state tracking reflects weaknesses in input validation and boundary enforcement during internal system transitions, akin to CWE-362 regarding concurrent execution issues where race conditions or stale states cause unexpected behavior. In terms of adversarial tactics, while this is primarily a stability bug rather than an exploitable attack vector for privilege escalation, it could be leveraged by a local attacker with the ability to trigger hardware resets to induce denial of service against network services running on the device, mapping loosely to ATT&CK technique T1499 which involves endpoint denial of service through resource exhaustion.
The resolution implemented in this patch addresses these flaws by explicitly clearing the valid_links bitmask within the reset virtual interface iterator and resetting the MLD index masks concurrently with existing omac mask clearings. This ensures that upon a full chip reset, all stale state indicators are wiped clean before mac80211 begins its reconfiguration replay. By doing so, mt7996_vif_link_add() will correctly identify links as needing recreation rather than skipping them due to false positives in the validity check. Furthermore, resetting the index masks prevents the accumulation of leaked indices, ensuring that each reset cycle starts with a clean slate for resource allocation. This fix restores proper operational continuity after resets and eliminates the long-term risk of resource exhaustion, thereby maintaining both immediate connectivity stability and long-term system reliability for devices relying on mt7996-based Wi-Fi adapters.