CVE-2026-90375 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix non-AQL packet accounting for MLO stations
__mt76_tx_queue_skb() overrides the wcid passed by the driver with sta->drv_priv, so the wcid might incorrectly be changed after TX, causing wcid->non_aql_packets to be counted on the wrong wcid. For example, on the AP side, if a station's setup link is the 5G link and the station uses 2G to transmit a frame, the value of non_aql_packets is increased on the 5G wcid but decreased on the 2G wcid. Once the inflated counter exceeds MT_MAX_NON_AQL_PKT, the TX scheduler permanently refuses to service the station.
Drop the reassignment and account on the wcid used for transmission. This also records the actual wcid in the queue entry.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Linux kernel's mt76 wireless driver involves a critical logic error in how packet accounting is managed for Multi-Link Operation stations, specifically affecting non-AQL packet tracking. The core technical flaw resides in the __mt76_tx_queue_skb function, which incorrectly overrides the Wireless Context Identifier passed by the driver with sta->drv_priv. This reassignment causes the wcid to be modified after transmission has occurred, leading to a mismatch between the actual interface used for data transfer and the context identifier where metrics are recorded. In environments utilizing Multi-Link Operation, such as those supporting simultaneous connections on both 2G and 5G bands, this error manifests when a station's setup link is one band but transmits frames over another. For instance, if a station establishes its primary connection on the 5GHz band but sends data via the 2.4GHz band, the non-AQL packet counter is erroneously incremented on the 5GHz wcid while being decremented on the 2G wcid. This discrepancy results in an inflated count of non-ACK Quality Limited packets for the wrong context, which directly impacts the TX scheduler's ability to manage traffic flow effectively.
The operational impact of this vulnerability is severe and can lead to a denial of service condition for affected wireless stations. The Linux kernel employs a threshold mechanism defined by MT_MAX_NON_AQL_PKT to monitor packet loss or transmission quality issues. When the non-AQL counter on an incorrect wcid exceeds this maximum limit due to the accounting error, the TX scheduler permanently refuses to service that station. This effectively cuts off network connectivity for devices relying on Multi-Link Operation features, as the scheduler interprets the artificially inflated metric as a persistent failure in transmission quality rather than a software bug. The issue highlights a significant gap in how state is maintained across different physical links within a single logical connection, undermining the reliability of modern Wi-Fi standards that depend on seamless link aggregation and failover capabilities.
From a security perspective, this vulnerability aligns with CWE-665, which describes improper use of deliberately incorrect values or logic errors leading to unintended behavior. The mismanagement of state variables across different execution contexts allows for resource exhaustion through the artificial inflation of error counters, potentially enabling local denial of service attacks if an attacker can trigger specific transmission patterns that exploit this accounting flaw. Furthermore, in the context of the MITRE ATT&CK framework, this issue relates to techniques involving resource consumption and availability impact, specifically under tactics such as Impact or Defense Evasion depending on whether the exploitation is intentional or accidental. The failure to correctly map operational metrics to their corresponding hardware contexts represents a fundamental weakness in system integrity monitoring mechanisms within network drivers.
To mitigate this vulnerability, the recommended approach involves correcting the logic within __mt76_tx_queue_skb by removing the erroneous reassignment of the wcid and ensuring that packet accounting occurs strictly on the wcid actually used for transmission. Additionally, recording the actual wcid in the queue entry provides a more accurate audit trail and prevents future discrepancies between logical connections and physical transmissions. System administrators should apply kernel updates or patches provided by their distribution vendors that include this fix to restore proper functionality of Multi-Link Operation features. Regular auditing of wireless driver configurations and monitoring for unusual drops in throughput on specific bands can help detect residual issues before they lead to complete service disruption. Maintaining up-to-date firmware and kernel versions is essential to prevent exploitation of such logic errors that compromise network stability and performance metrics.