{"id":"CVE-2026-90380","summary":"wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete\n\nA use-after-free issue occurs in mt76_rx_poll_complete due to a race\ncondition. The STA has already been removed, but the rx_status still\nhad a pointer to the wcid in the STA.\n\nSet the links' wcid pointers to be NULL for a MLD in\nmt7925_sta_pre_rcu_remove()\n\nBUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470\nCall trace:\ndump_backtrace+0xec/0x128\nshow_stack+0x18/0x28\ndump_stack_lvl+0x40/0xc8\nprint_report+0x1b8/0x710\nkasan_report+0xe0/0x144\ndo_bad_area+0x120/0x260\ndo_tag_check_fault+0x20/0x34\ndo_mem_abort+0x54/0xa8\nel1_abort+0x3c/0x5c\nel1h_64_sync_handler+0x40/0xcc\nel1h_64_sync+0x7c/0x80\nmt76_rx_poll_complete+0x280/0x470\nmt76_dma_rx_poll+0x114/0x51c\nmt792x_poll_rx+0x60/0xf8\nnapi_threaded_poll_loop+0xe0/0x450\nnapi_threaded_poll+0x80/0x9c\nkthread+0x11c/0x158\nret_from_fork+0x10/0x20","modified":"2026-09-19T03:47:26.163815152Z","published":"2026-09-17T16:09:17.948Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90380.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/217f9e7bb02558759be9d9ecfe532e9708741c50"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aaf414bf81ab4b680580871784b0b929818188eb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b250943f3f8351385a17972bda001664a5c51008"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90380.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90380"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c948b5da6bbec742b433138e3e3f9537a85af2e5"},{"fixed":"aaf414bf81ab4b680580871784b0b929818188eb"},{"fixed":"b250943f3f8351385a17972bda001664a5c51008"},{"fixed":"217f9e7bb02558759be9d9ecfe532e9708741c50"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90380.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90380.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}