{"id":"CVE-2026-90354","revision":"b4daa373ec344b3e86bf5521f135f4ac","records":[{"revision":"b4daa373ec344b3e86bf5521f135f4ac","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90354","aliases":[],"title":"wifi: mt76: mt7915: fix double hif2 init on the non-WED path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix double hif2 init on the non-WED path\n\nmt7915_pci_init_hif2() was called unconditionally and again inside the\nWED-inactive branch. The helper increments the global hif_idx, writes the\nPCIe RECOG_ID register and takes a get_device() reference via\nmt7915_pci_get_hif2(), while removal only drops one reference. On non-WED\ndual-hif hardware this double-incremented hif_idx, wrote RECOG_ID twice and\nleaked a device reference. Only the call inside the WED-inactive branch is\ncorrect; drop the unconditional one. hif2 is already initialised to NULL.","state":0,"publishedAt":"2026-09-17T16:09:00.88+00:00","modifiedAt":"2026-10-19T09:02:10.824+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7915/pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cacdd67812c6df824704ac078f1770188a485ff9\",\n                            \"lessThan\": \"eac18fadc791928379b179e54636494b92f8cf86\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cacdd67812c6df824704ac078f1770188a485ff9\",\n                            \"lessThan\": \"927fe8c0eb8c10295bc0018c8faa4d91f8fe98c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cacdd67812c6df824704ac078f1770188a485ff9\",\n                            \"lessThan\": \"bd2e8f535ae35beb45a7fcc17ec9bbf8dc4db5fe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cacdd67812c6df824704ac078f1770188a485ff9\",\n                            \"lessThan\": \"249cbaa1873550689fab136b74982cbba74c4169\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cacdd67812c6df824704ac078f1770188a485ff9\",\n                            \"lessThan\": \"29fbc5256c2d8448f084ff179d2e5092ecd1fc54\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cacdd67812c6df824704ac078f1770188a485ff9\",\n                            \"lessThan\": \"3ae8ad277e2819a281b0e36b55633c8515c16ce7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7915/pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/eac18fadc791928379b179e54636494b92f8cf86","https://git.kernel.org/stable/c/927fe8c0eb8c10295bc0018c8faa4d91f8fe98c6","https://git.kernel.org/stable/c/bd2e8f535ae35beb45a7fcc17ec9bbf8dc4db5fe","https://git.kernel.org/stable/c/249cbaa1873550689fab136b74982cbba74c4169","https://git.kernel.org/stable/c/29fbc5256c2d8448f084ff179d2e5092ecd1fc54","https://git.kernel.org/stable/c/3ae8ad277e2819a281b0e36b55633c8515c16ce7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90354","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90354","identifiers":["CVE-2026-90354"]},"retained":false,"historicalAffected":[]}],"coverage":[]}