CVE-2026-90349 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of the affected Linux kernel versions should be aware of this vulnerability and take steps to mitigate it. Affected operators and platforms should assess their exposure and apply patches or mitigations. Vulnerability management and security teams should prioritize patching and monitor for suspicious activity related to the vulnerability.

Why it matters

The CVE-2026-90349 vulnerability in the Linux kernel's wifi mt76 mt7996 driver could allow an attacker to access out-of-bounds link arrays, potentially leading to sensitive data access or disruption of network operations.

• An attacker could potentially access sensitive data or disrupt network operations
• The vulnerability could be used as a vector for further exploitation
• The fix may require updates to the Linux kernel, which could impact system availability

Technical summary

The vulnerability is caused by an out-of-bounds link array access in the mt7996_tx() function of the Linux kernel's wifi mt76 mt7996 driver. When mac80211 leaves the link unspecified, the function uses an unchecked value to index vif->link_conf[], mvif->mt76.link[], and sta->link[]. The primary link id should be clamped to the default link before use to prevent out-of-bounds access. This issue could allow an attacker to access sensitive data or disrupt network operations. The fix involves updating the Linux kernel to properly handle link array indexing.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers
• Update to a version of the Linux kernel that includes the fix
• Monitor for any suspicious activity related to the vulnerability
• Perform a thorough review of system configurations and exposed assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. Linux kernel maintainers and users should verify the fix and assess their exposure. Evidence is limited to public CVE details and source item information. Defensive verification tasks include reviewing the Linux kernel source code and assessing system configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.