CVE-2026-90380 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel maintenance and security should assess exposure to this vulnerability. They should verify Linux kernel versions, monitor for potential use-after-free issues, and apply patches or updates as available.

Why it matters

CVE-2026-90380 is a use-after-free vulnerability in the Linux kernel that requires verification of affected scope and remediation from official sources. Defenders should prioritize verifying Linux kernel versions and assessing exposure to this vulnerability.

• Verification of Linux kernel versions is required to determine exposure.
• Potential use-after-free issues in the mt76_rx_poll_complete function may require monitoring and patching.
• Remediation priority is high due to the HIGH severity rating and CVSS score of 8.8.

Technical summary

The CVE-2026-90380 vulnerability is a use-after-free issue in the Linux kernel's mt76_rx_poll_complete function. This occurs due to a race condition where a STA has been removed, but the rx_status still references the wcid in the STA. The vulnerability has been addressed with a patch that sets the links' wcid pointers to NULL for a MLD in mt7925_sta_pre_rcu_remove(). Affected Linux kernel versions require verification to determine exposure. Defenders should prioritize verifying Linux kernel versions and assessing exposure to this vulnerability. They should also monitor for potential use-after-free issues in the mt76_rx_poll_complete function and review compensating controls for exposed systems.

Defensive priority

Defenders should prioritize verifying Linux kernel versions and assessing exposure to this vulnerability. They should also monitor for potential use-after-free issues in the mt76_rx_poll_complete function.

Recommended defensive actions

• Verify Linux kernel versions for potential exposure to CVE-2026-90380
• Assess and monitor mt76_rx_poll_complete function for use-after-free issues
• Review and apply patches or updates for the Linux kernel as available
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a CVSS score of 8.8 and a HIGH severity rating. However, the exact affected Linux kernel versions and exploitation details are not specified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.