HIGH Introduced in 6.18
mt76 RxdmadC Race
CVE-2026-90371
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMAD_C buffer recycling race The RXDMAD_C buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the non-direct path as is already done for WED RX queues.
02KernelScan AI Analysis
Risk summary
A race condition in the MediaTek mt76 WiFi driver's receive buffer recycling can corrupt kernel heap memory when processing incoming WiFi frames on devices with HW-RRO v3.1 chipsets (MT7992/MT7996). An attacker within WiFi range can trigger the race by sending frames to the target, potentially achieving code execution or crashing the kernel. Devices without affected MediaTek WiFi hardware are not impacted.
Vulnerability analysis
When the mt76 WiFi driver processes received frames on MediaTek chipsets supporting HW-RRO v3.1, it recycles RXDMAD_C buffers using a direct page-pool path. These buffers originate from page pools owned by a different NAPI context, so the direct recycle can race with that owner, corrupting kernel heap memory. The fix routes RXDMAD_C queues through the non-direct recycle path—already used for WED RX queues—so buffers are returned safely without racing the owning NAPI. The vulnerability is reachable by any attacker within WiFi range of a device using an affected MediaTek chipset; no privileges on the target are required, only the ability to transmit WiFi frames that trigger receive processing.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.18 | 7.2.6 | a273dc3b86a7 |
| 6.18 | 6.18 | 6.18.52 | 7ac05ed3a50e |
| mainline | 6.18 | 7.3-rc1 | e1f97c10a4ec |