CVE-2026-90376 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...".
Root cause: If the MLD_ID field in the TXD is neither the primary link id nor the secondary link id, it may lead to a firmware busy loop when the third link is in power saving mode.
Remap frames directed to a third link to the primary link wcid. Since TX status events and txfree completions carry the wcid the firmware saw, use the remapped wcid for packet id tracking and non-AQL packet accounting as well, while the frame keeps its original link context for addressing, band and OMAC selection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's mt76 wireless driver, specifically within the mt7996 subsystem, represents a critical logic error affecting Multi-Link Operation (MLO) functionality. This issue manifests as MCU command timeouts occurring despite the firmware reporting a normal operational state, accompanied by persistent error logs indicating that no pause was received from the hardware or firmware components. The root cause lies in the incorrect handling of the MLD_ID field within the Transmission Descriptor (TXD). When this identifier is set to neither the primary link ID nor the secondary link ID, it effectively designates a third logical link for transmission operations. Under specific conditions where this third link enters power saving mode, the misconfigured descriptor triggers an infinite busy loop within the firmware logic, leading to resource exhaustion and communication failures between the host driver and the wireless hardware.
From a technical perspective, the flaw stems from insufficient validation of multi-link identifiers during packet preparation for transmission. In Wi-Fi 7 (802.11be) environments utilizing MLO, frames can be transmitted over multiple simultaneous links to improve throughput and reliability. The MT7996 chipset relies on accurate mapping of these logical links to physical hardware contexts known as Wireless Context Identifiers (WCID). When the MLD_ID does not correspond to an active primary or secondary link context that is fully awake, the firmware fails to handle the state transition correctly during power saving events. This results in a deadlock scenario where the driver waits for acknowledgments or status updates from the MCU, which are never generated due to the internal firmware loop caused by the invalid link reference.
The operational impact of this vulnerability includes significant degradation of wireless performance and potential denial-of-service conditions for devices relying on MLO features. Users may experience intermittent connectivity drops, increased latency, and complete failure of data transmission over the affected links. Furthermore, the continuous error logging can contribute to system log clutter and potentially mask other underlying issues if not properly addressed. For enterprise environments or high-availability networks utilizing Wi-Fi 7 infrastructure, this bug undermines the reliability guarantees expected from multi-link aggregation protocols, leading to unpredictable network behavior during power management transitions.
To mitigate this vulnerability, it is essential to apply kernel updates that include the patch remapping frames directed to a third link back to the primary link WCID. This fix ensures that packet ID tracking and non-AQL (Advanced Queueing Logic) packet accounting utilize the correct hardware context while preserving the original frame's logical attributes such as band selection and OMAC identification for proper addressing. Administrators should ensure their systems are running patched versions of the Linux kernel where this logic error has been corrected. Additionally, monitoring system logs for MCU timeout warnings can serve as an early detection mechanism for affected deployments until full patching is achieved across all network endpoints.
This issue aligns with CWE-841 Improper Enforcement of Behavioral Workflow and CWE-756 Missing Custom Error Handling Mechanism within the context of embedded firmware interaction. In terms of MITRE ATT&CK, while primarily a stability defect rather than an exploit vector for malicious actors, it relates to Tactic TA0002 Execution through potential resource exhaustion leading to service disruption. The fix emphasizes robust state management and proper mapping of logical network interfaces to physical hardware resources, reinforcing the importance of rigorous validation in multi-link protocol implementations within modern wireless standards.