{"id":"CVE-2026-90367","summary":"wifi: mt76: mt7996: hold dev-\u003emt76.mutex while disabling tx worker in SER","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: hold dev-\u003emt76.mutex while disabling tx worker in SER\n\nmt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs\nbefore taking dev-\u003emt76.mutex. mt76_worker_disable()/_enable() are plain\nkthread park/unpark, not refcounted, and __mt76_set_channel() toggles the\nsame worker and the MT76_RESET bit under the mutex. An L1 SER racing a\nchannel switch could therefore have the worker unparked and MT76_RESET\ncleared while the reset path resets the DMA rings, corrupting descriptors\nor tokens. Take the mutex before disabling the worker, as mt7915 does.","modified":"2026-09-19T03:47:28.966457180Z","published":"2026-09-17T16:09:09.430Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90367.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90367.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90367"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"27015b6fbcca836c6dbf196afc266e068af4aeec"},{"fixed":"906ad486ba5c4933d82e1ebe0685656390a48450"},{"fixed":"594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701"},{"fixed":"6190db312b8230813f529f014b26247c6d9800d0"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90367.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90367.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}