CVE-2026-90377 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix RX data queuing of RRO 3.0
For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only polls skbs queued on the MT_RXQ_RRO_IND list; frames queued under the data queue id are left sitting on that list until the data queue NAPI happens to run, stalling and reordering RX data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel within the mt76 wireless driver subsystem involves a critical misconfiguration of receive (RX) data queuing mechanisms for RRO 3.0 hardware implementations. This issue stems from an incorrect assignment of network buffer descriptors to specific processing queues, leading to significant performance degradation and potential connectivity instability. The root cause lies in the handling of RX frames released from the primary RRO data queue. Instead of being directed to the indicator queue where they are intended for immediate processing by the corresponding NAPI poll context, these frames were erroneously left on or added to the data queue list. This architectural mismatch disrupts the expected flow of packet processing within the driver's internal state machine and interrupt handling logic.
From a technical perspective, the mt76 driver utilizes separate NAPI contexts for different types of traffic queues to optimize CPU utilization and reduce latency. The indicator queue is specifically designed to handle frames that require immediate attention or status updates, polling exclusively on skbs queued under the MT_RXQ_RRO_IND identifier. When data intended for this path is instead placed into the general data queue bucket, it becomes invisible to the indicator NAPI poller. Consequently, these packets remain stagnant in their respective list until the less frequently invoked data queue NAPI routine runs. This delay introduces substantial latency and causes packet reordering, as frames arrive out of sequence relative to other traffic streams that are being processed correctly by their designated queues.
The operational impact of this flaw is primarily characterized by degraded network performance rather than a direct security breach such as remote code execution or privilege escalation. Users may experience intermittent connectivity drops, increased latency, and reduced throughput on devices utilizing the affected mt76 hardware with RRO 3.0 capabilities. The reordering of RX data can confuse upper-layer protocols like TCP, which rely on in-order delivery for optimal congestion control and acknowledgment mechanisms. This results in unnecessary retransmissions and further exacerbates network inefficiency under load. While not a traditional vulnerability exploitable by an attacker to compromise system integrity, it represents a significant functional defect that undermines the reliability of wireless communications on affected systems.
This issue aligns with CWE-20 Improper Input Validation as it relates to the internal validation of queue assignment logic and data flow control within the driver. It also reflects principles found in ATT&CK technique T1496 Resource Hijacking, specifically regarding the inefficient use of system resources due to poor scheduling or queuing mechanisms that lead to performance degradation. The fix involves correcting the pointer assignments so that released RX frames are correctly enqueued onto the indicator queue list. This ensures they are promptly picked up by the appropriate NAPI poll context, restoring proper packet ordering and processing latency. System administrators should apply kernel updates containing this patch to restore optimal wireless performance on affected hardware configurations.