CVE-2026-90373 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
mt7915_remove_interface() cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the allocators, which all run under dev->mt76.mutex; on DBDC the two wiphys share one mt76_dev, so this raced add_interface/sta_add on the other band and could leak or double-hand-out a wcid. Clearing the bit before the RCU pointer also let a concurrent allocation reuse the index and publish its wcid, which the subsequent NULL assignment then wiped. Move the clear into the existing mutex section, after the RCU pointer is cleared.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's mt7915 wireless driver represents a critical concurrency flaw rooted in improper synchronization of shared data structures during interface removal operations. Specifically, within the mt7915_remove_interface function, the code was clearing the Wireless Context Identifier mask bit without holding the necessary device mutex and before nullifying the associated RCU pointer to the wcid structure. This sequence error creates a race condition because the wcid mask is a non-atomic read-modify-write shared resource that must be protected by dev->mt76.mutex, which governs all allocator operations including interface additions and station additions. The lack of proper locking allows concurrent threads to access or modify this state inconsistently, leading to severe integrity violations in memory management and resource allocation for wireless contexts.
The operational impact of this flaw is particularly pronounced in devices supporting Dual Band Concurrent operation, where two physical wireless interfaces share a single mt76_dev structure. In such configurations, the race condition can occur between an interface removal on one band and an interface or station addition on the other band sharing the same device context. This concurrency issue results in either the leakage of wcid resources, which prevents their reuse and eventually leads to resource exhaustion, or the double-handing out of a single wcid index to multiple contexts. Such duplication compromises network stability and security by allowing potentially conflicting operations to proceed using the same identifier, effectively breaking the isolation between different wireless connections managed by the driver.
Furthermore, the specific ordering error where the mask bit is cleared before the RCU pointer allows for an even more dangerous scenario involving use-after-free or data corruption. By clearing the allocation slot in the mask prematurely, a concurrent allocator thread can reuse that index and publish its own wcid structure into it. Subsequently, when the original removal operation proceeds to nullify the RCU pointer, it inadvertently overwrites or wipes out the newly published wcid belonging to another active context. This not only corrupts the state of the new connection but also leaves the system in an inconsistent state where resources are mismanaged and data integrity is compromised.
To mitigate this vulnerability, the fix involves reordering the operations within mt7915_remove_interface so that the RCU pointer is cleared first while still under the protection of the mutex, followed by clearing the wcid mask bit within the same locked section. This ensures that no other thread can allocate or reuse the wcid index until it has been safely removed from all active references and the lock protecting the shared state remains held throughout the entire cleanup process. Developers should ensure that any modification to non-atomic shared resources in concurrent environments is strictly serialized using appropriate mutexes and that pointer dereferences are handled with RCU primitives correctly ordered relative to resource deallocation.
From a classification perspective, this vulnerability aligns with CWE-362, which describes Concurrent Execution Using Shared Resource with Improper Synchronization, commonly known as a race condition. The improper handling of shared state without adequate locking mechanisms is the core technical deficiency here. In terms of attack vectors and behavioral analysis, this flaw relates to ATT&CK technique T1059, specifically sub-techniques involving command or script interpretation if an attacker can trigger specific interface configurations rapidly, although primarily it serves as a stability issue rather than a direct exploitation vector for privilege escalation in most standard deployments. However, the potential for resource exhaustion via wcid leakage could be leveraged to cause denial of service against wireless connectivity services on affected systems.