HIGH Introduced in 6.15
mt76 LinkId OOB
CVE-2026-90350
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76_vif_link() mt76_vif_link() indexes mvif->link[] without validating link_id, but callers pass mvif->deflink_id / msta->deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link. Reachable via mt7996_set_tsf()/mt7996_offset_tsf() and mt7996_net_fill_forward_path(). Bounds check link_id and return NULL, matching mt7996_sta_link() and mt7996_sta_link_protected().
02KernelScan AI Analysis
Risk summary
A missing bounds check in the MediaTek mt76 WiFi driver allows an out-of-bounds array read when a virtual interface has not yet had any links added. The read returns a pointer from an adjacent data field, which callers then use as a valid link structure — a type confusion that can crash the kernel or corrupt data. Only systems with MT7996-series WiFi hardware and the mt76 driver loaded are affected.
Vulnerability analysis
The MediaTek mt76 WiFi driver looks up a virtual interface link using an identifier as an array index without checking whether it is within bounds. When an interface has not yet had any links added, the identifier holds a special out-of-range value, causing the lookup to read past the end of the array. That location overlaps a different field in the same structure, so the driver receives a pointer to the wrong type of object and uses it as a valid link — a type confusion that can crash the kernel, leak kernel memory, or corrupt data handled by hardware offloading and forwarding paths. The fix adds a bounds check that rejects out-of-range identifiers before the lookup, consistent with how similar operations are already validated. The issue can be reached through local WiFi configuration operations that adjust timing or set up forwarding, which require network-admin capability obtainable by an unprivileged local user via user namespaces on systems that allow it, and only affects devices with MT7996-series WiFi hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.15 | 7.2.6 | c1442c345ca8 |
| mainline | 6.15 | 7.3-rc1 | 9ba744a28c26 |
| 6.18 | 6.15 | 6.18.52 | 13f6a9c78602 |