CVE-2026-90372 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
If a peer's VHT/HE MCS map has no supported spatial stream (all fields 0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255), which was then written into the firmware sta_rec_bf beamforming fields. Clamp the result to 0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel within the MediaTek mt7915 Wi-Fi driver involves a logic error during the processing of spatial stream configurations for station records. Specifically, the function mt7915_mcu_get_sta_nss is responsible for determining the number of supported spatial streams (NSS) based on the VHT or HE MCS maps provided by connected peers. Under normal circumstances, this value dictates how beamforming and other multi-user MIMO features are configured in the firmware station record structure. However, a flaw exists where if a peer's configuration indicates no supported spatial streams, represented by specific field values such as 0x3 across all relevant bits, the internal loop logic fails to handle this edge case correctly. Instead of initializing or maintaining a valid zero count for non-supported streams, the variable tracking the NSS count remains at an uninitialized state or defaults in a way that leads to an underflow condition when processed further down the execution path.
This logical flaw results in the function returning a value cast as an unsigned 8-bit integer with a maximum value of 255, which corresponds to (u8)-1 in signed arithmetic terms before truncation. This erroneous high value is subsequently written directly into the firmware sta_rec_bf beamforming fields without any validation or clamping mechanism. The immediate operational impact of this behavior is significant because it misinforms the wireless firmware about the capabilities and requirements of the connected station. By setting the spatial stream count to an abnormally high number, the driver may attempt to allocate resources incorrectly or configure transmission parameters that are physically impossible for the hardware or the peer device to support. This can lead to unstable Wi-Fi connections, degraded performance, or in severe cases, a denial of service condition where the wireless interface becomes unresponsive due to firmware confusion or internal error states triggered by invalid configuration data.
From a security and standards perspective, this issue aligns with CWE-190, which describes integer overflow or wraparound errors that can lead to unexpected behavior when arithmetic operations exceed the bounds of their data types. Although the immediate manifestation is a logic error rather than a direct buffer overwrite, the propagation of an invalid large value into firmware structures creates a risk for further exploitation if other parts of the driver assume valid ranges for these parameters. Furthermore, this type of input validation failure can be categorized under CWE-20, Improper Input Validation, as the system fails to adequately sanitize or verify the derived NSS count before applying it to critical hardware configuration registers. In terms of adversarial tactics, while not a direct remote code execution vector in its current form, such misconfigurations could potentially contribute to availability impacts similar to those seen in ATT&CK technique T1498, Network Denial of Service, by causing the wireless subsystem to malfunction or crash under specific connection scenarios.
The resolution for this vulnerability involves implementing explicit bounds checking and clamping logic within the mt7915_mcu_get_sta_nss function. By ensuring that the calculated NSS value is constrained to a valid range, specifically preventing negative results from being interpreted as large positive integers due to unsigned type casting, the driver maintains consistency with hardware expectations. The fix explicitly clamps the result to zero when no spatial streams are supported, thereby avoiding the transmission of the erroneous 255 value to the firmware. This correction ensures that beamforming and MIMO configurations remain accurate relative to actual peer capabilities. To mitigate similar risks in broader system administration, it is recommended to keep kernel packages updated with the latest security patches provided by distribution vendors. Additionally, developers should review other areas of network driver code for similar patterns where derived values from external inputs are used without sufficient range validation, adhering to secure coding practices that prioritize defensive programming against integer underflow and overflow scenarios.