CVE-2026-90367 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using WiFi mt76 drivers, should assess exposure and prioritize patching. This includes verifying patch application, assessing exposure, and monitoring for updates from Linux kernel maintainers. The vulnerability's operational impact requires attention from operator, platform, vulnerability-management, and security teams to ensure proper mitigation.

Why it matters

A high-severity vulnerability in the Linux kernel's WiFi mt76 driver requires verification and patching to prevent potential corruption of descriptors or tokens.

• Verify patch application for Linux kernel versions
• Assess exposure of WiFi mt76 driver usage
• Monitor for updates from Linux kernel maintainers

Technical summary

The vulnerability occurs in the Linux kernel's WiFi mt76 driver, specifically in the mt7996_mac_reset_work() function. The issue arises when the tx worker is disabled in SER, which could lead to corruption of descriptors or tokens. The fix involves taking the dev->mt76.mutex before disabling the worker, as mt7915 does. This change ensures that the worker is properly synchronized, preventing potential corruption. The affected product context includes Linux kernel-based systems using WiFi mt76 drivers, requiring defensive impact assessment and source-grounded technical framing.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those using WiFi mt76 drivers.

Recommended defensive actions

• Verify Linux kernel versions for potential exposure
• Apply patches for affected WiFi mt76 driver versions
• Monitor for updates from Linux kernel maintainers
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and severity. However, specific details about affected versions and exploitation are limited. Defenders should verify patch application for Linux kernel versions, assess exposure of WiFi mt76 driver usage, and monitor for updates from Linux kernel maintainers. The source grounding indicates that the CVE Program and NVD provide official records, but further verification is needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.