{"id":"CVE-2026-90367","revision":"4edb81b9f5364a6ab291f8e64b642f8b","records":[{"revision":"4edb81b9f5364a6ab291f8e64b642f8b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90367","aliases":[],"title":"wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER\n\nmt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs\nbefore taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain\nkthread park/unpark, not refcounted, and __mt76_set_channel() toggles the\nsame worker and the MT76_RESET bit under the mutex. An L1 SER racing a\nchannel switch could therefore have the worker unparked and MT76_RESET\ncleared while the reset path resets the DMA rings, corrupting descriptors\nor tokens. Take the mutex before disabling the worker, as mt7915 does.","state":0,"publishedAt":"2026-09-17T16:09:09.43+00:00","modifiedAt":"2026-10-21T12:51:20.196+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"27015b6fbcca836c6dbf196afc266e068af4aeec\",\n                            \"lessThan\": \"bc4f4389f439e808185778d298da36976d13d415\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"27015b6fbcca836c6dbf196afc266e068af4aeec\",\n                            \"lessThan\": \"69f23622533a4f054b5c8fdb226c3319ffa017b6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"27015b6fbcca836c6dbf196afc266e068af4aeec\",\n                            \"lessThan\": \"906ad486ba5c4933d82e1ebe0685656390a48450\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"27015b6fbcca836c6dbf196afc266e068af4aeec\",\n                            \"lessThan\": \"594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"27015b6fbcca836c6dbf196afc266e068af4aeec\",\n                            \"lessThan\": \"6190db312b8230813f529f014b26247c6d9800d0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/bc4f4389f439e808185778d298da36976d13d415","https://git.kernel.org/stable/c/69f23622533a4f054b5c8fdb226c3319ffa017b6","https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450","https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701","https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90367","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90367","identifiers":["CVE-2026-90367"]},"retained":false,"historicalAffected":[]}],"coverage":[]}