HIGH Introduced in 5.16
mt7915 TWTFlow UAF
CVE-2026-90357
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.
02KernelScan AI Analysis
Risk summary
A WiFi client within range of an access point using the MediaTek MT7915 chipset can trigger a list corruption bug in the TWT (Target Wake Time) setup path. When firmware rejects a TWT agreement, the driver leaves a stale entry on its internal tracking list, which is then reused and zeroed while still linked. This can lead to kernel memory corruption, crash, or potential code execution on the access point.
Vulnerability analysis
When a WiFi client sends a TWT setup request to an access point using the MediaTek MT7915 driver, the driver adds a flow entry to its internal tracking list before asking the firmware to accept the agreement. If the firmware rejects the request, the error path returns without removing the entry from the list. The flow slot is then eligible for reuse and gets zeroed while still linked, corrupting the list structure. Subsequent operations that walk the list encounter dangling or corrupted entries, leading to kernel memory corruption. The fix removes the flow from the list on the firmware-rejection error path before returning. This vulnerability is reachable by any WiFi client within range of an affected access point; no special privileges are needed beyond normal wireless association.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.16 | 6.1.188 | c09d1b15ed2d |
| 6.12 | 5.16 | 6.12.110 | cabe239e95b4 |
| 6.18 | 5.16 | 6.18.52 | 6bce0f1280c9 |
| 6.6 | 5.16 | 6.6.157 | 1bd5c4ed2b90 |
| 7.2 | 5.16 | 7.2.6 | beaa42b87596 |
| mainline | 5.16 | 7.3 | 16a04441eab0 |
| cip/6.1 | 5.16 | 6.1.189-cip61 | c09d1b15ed2d |
| cip/6.1-rt | 5.16 | 6.1.189-cip61-rt32 | c09d1b15ed2d |
| cip/6.12 | 5.16 | 6.12.111-cip32 | cabe239e95b4 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |