{"id":"CVE-2026-90355","revision":"353f88251c4944188f133240af28aefd","records":[{"revision":"353f88251c4944188f133240af28aefd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90355","aliases":[],"title":"wifi: mt76: mt7996: clear stale link state on full reset","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: clear stale link state on full reset\n\nAfter a full chip reset, mac80211 reconfig replays interface, link and\nchannel context setup. mt7996_vif_link_add() short-circuits when the\nlink_id is still marked in mvif->valid_links, a state introduced for\npostponing link teardown to interface removal. The reset path frees the\nlink structures without clearing those bits, so the replayed setup never\nre-creates dev_info/bss_info/STA records in the restarted firmware and\nnever re-registers the link wcid, leaving the device inoperative.\n\nThe reset path also leaks every allocated MLD index: per-link indices\nand the per-vif group/remap indices are re-allocated from scratch during\nreconfig, but the old bits stay set in the masks, so repeated full\nresets exhaust the index space.\n\nClear valid_links in the reset vif iterator and reset the MLD index\nmasks alongside the existing omac_mask clearing.","state":0,"publishedAt":"2026-09-17T16:09:01.543+00:00","modifiedAt":"2026-10-19T09:02:11.737+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ace5d3b6b49e8391beb4d7244348ba7da5298878\",\n                            \"lessThan\": \"e512823aabbdc91444b9d886638f059ef58e86b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ace5d3b6b49e8391beb4d7244348ba7da5298878\",\n                            \"lessThan\": \"fc3762724a36867c1749233c43368c2637ecf029\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ace5d3b6b49e8391beb4d7244348ba7da5298878\",\n                            \"lessThan\": \"75d2a4e2129b58bb0ddb842387299038495aad2a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e512823aabbdc91444b9d886638f059ef58e86b1","https://git.kernel.org/stable/c/fc3762724a36867c1749233c43368c2637ecf029","https://git.kernel.org/stable/c/75d2a4e2129b58bb0ddb842387299038495aad2a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90355","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90355","identifiers":["CVE-2026-90355"]},"retained":false,"historicalAffected":[]}],"coverage":[]}