HIGH Introduced in 6.4
mt76 TxWorker Race
CVE-2026-90367
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER mt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex. An L1 SER racing a channel switch could therefore have the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens. Take the mutex before disabling the worker, as mt7915 does.
02KernelScan AI Analysis
Risk summary
A race condition in the MediaTek mt7996 WiFi driver's system error recovery (SER) path can corrupt DMA descriptors or tokens when a hardware reset races with a channel switch. An attacker within WiFi range could potentially trigger this to cause memory corruption, leading to denial of service or potential code execution.
Vulnerability analysis
The mt7996 WiFi driver's system error recovery routine disables the transmit worker and NAPI contexts before acquiring the device mutex, while the channel-switch path toggles the same worker and reset flag under that mutex. If a hardware-level system error recovery event coincides with a channel switch, the worker can be prematurely unparked and the reset flag cleared while the recovery path is still resetting DMA rings, corrupting descriptors or tokens. The fix moves the mutex acquisition before the worker disable, ensuring the reset and channel-switch paths are mutually exclusive. This is reachable by an attacker within wireless range of the affected MediaTek mt7996 device, requiring no authentication or privileges beyond the ability to trigger or time a channel switch against a SER event.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.4 | 6.12.114 | 69f23622533a |
| 6.18 | 6.4 | 6.18.52 | 906ad486ba5c |
| 6.6 | 6.4 | 6.6.160 | bc4f4389f439 |
| 7.2 | 6.4 | 7.2.6 | 594c4b7f89f9 |
| mainline | 6.4 | 7.3 | 6190db312b82 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |