Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-90382

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a corrupted frame can report a length larger than the received buffer. The bounds check correctly discards such frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage frame taints the kernel, and panics it on the first such frame when panic_on_warn is set. Drop the WARN and discard the frame silently, matching what commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx status and rx path") did for the neighboring rx and tx status paths. Observed immediately on rx with an MT7612U in fcsfail monitor mode on a busy channel.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in 61b1f6d92249bc34580ff19de7c69c805f82adca; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in d55e7aede542c4c76ead82d37d0c112f21eb2ac2; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in b6e7958602bd1acdb8ae92703b6689a28bcc9bc0; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in 2d31e332c13b1db7745a7bd9cf74bc105524bcac; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in 17d6b89e09eac2d90272fceeba3644e92212e02f; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in 6def491fe9c4e83aa8cba62d74e9d4ab751ee967; From 7bc04215a66b60e198aecaee8418f6d79fa19faa · fixed in 81497634d9f872fd3e8b03aada55574afff6f174

  • Linux Linux

    4.16

  • KernelLinux

    From 4.16.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8

git.kernel.org