{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-90353", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.805Z", "datePublished": "2026-09-17T16:09:00.217Z", "dateUpdated": "2026-10-19T09:02:09.864Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:02:09.864Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix ext PHY use-after-free on register error path\n\nAfter mt7915_register_ext_phy() succeeded, a failure of the main PHY\nmt7915_init_debugfs() or mt7915_coredump_register() unwound through\nfree_phy2, which called ieee80211_free_hw() on the ext PHY hw while it\nwas still registered with mac80211, since mt76_unregister_device() only\nunregisters the main hw. Unregister the ext PHY (thermal + phy + hw)\nfirst and skip the redundant free." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The UAF is in mt7915_register_device()'s free_phy2 unwind, reached only from mt7915_pci_probe() and mt798x_wmac_probe() when mt7915_init_debugfs() or mt7915_coredump_register() fails after mt7915_register_ext_phy(); no 802.11 frame or nl80211 command supplies the triggering data.\nAC:H - mt7915_init_debugfs() always returns 0, so the live branch is mt7915_coredump_register() failing its vzalloc of struct mt7915_crash_data after mt7915_alloc_ext_phy() produced phy2 (DBDC). That one-shot ENOMEM during pci/platform probe is not something an attacker can reliably force.\nPR:L - After ieee80211_free_hw() on the still-registered ext PHY, mt76_unregister_device() drops only the main hw, leaving the ext wiphy, the default STA vif from ieee80211_register_hw(), and mt7915_thermal_ops (cdev->devdata = phy) reachable via nl80211 and thermal sysfs without init-namespace root or PCI bind capability.\nUI:N - No victim must mount media or open a file; once the probe unwind runs, udev, mac80211's leftover workqueue/inetaddr notifier, or the attacker’s own nl80211/thermal access touches the still-registered ext PHY.\nS:U - ieee80211_free_hw() frees the ext PHY's ieee80211_local/wiphy/sband while mac80211 still holds it; impact is host-kernel heap corruption, not a VM, IOMMU, or sandbox escape.\nC:H - ieee80211_free_hw() kfree's the ext PHY's still-registered wiphy bands and wiphy_free()s the hw while cfg80211 and mt7915_thermal_get_cur_throttle_state() still dereference that phy via cdev->devdata, a UAF read primitive.\nI:H - The leftover ext-PHY object is written by mt7915_thermal_set_cur_throttle_state() (phy->cdev_state and mt7915_mcu_set_thermal_throttling) and by mac80211 workqueues never torn down by ieee80211_unregister_hw(), enabling UAF writes and control-flow hijack.\nA:H - ieee80211_free_hw() without ieee80211_unregister_hw() leaves mac80211 workqueues, inetaddr notifiers, and the default wlan vif running against freed ieee80211_local, which oopses or panics on the next access." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mt7915/init.c" ], "versions": [ { "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "aa55bec92ba7747dd08feff409f8074c5e052e71", "status": "affected", "versionType": "git" }, { "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "ad706fcf6255494613b94418e7243d98065dbeaf", "status": "affected", "versionType": "git" }, { "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "34058ad122f7524e33df8e38caba4b1d803b025a", "status": "affected", "versionType": "git" }, { "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5", "status": "affected", "versionType": "git" }, { "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "648f5f03ff50d4bd719106ace0cdf1d8be02cbdd", "status": "affected", "versionType": "git" }, { "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "15b960014f24dce5388d4a2e7274e6490cb3c421", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mt7915/init.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.188" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/aa55bec92ba7747dd08feff409f8074c5e052e71" }, { "url": "https://git.kernel.org/stable/c/ad706fcf6255494613b94418e7243d98065dbeaf" }, { "url": "https://git.kernel.org/stable/c/34058ad122f7524e33df8e38caba4b1d803b025a" }, { "url": "https://git.kernel.org/stable/c/a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5" }, { "url": "https://git.kernel.org/stable/c/648f5f03ff50d4bd719106ace0cdf1d8be02cbdd" }, { "url": "https://git.kernel.org/stable/c/15b960014f24dce5388d4a2e7274e6490cb3c421" } ], "title": "wifi: mt76: mt7915: fix ext PHY use-after-free on register error path", "x_generator": { "engine": "bippy-1.2.0" } } } }