CVE-2026-90350
kernel: wifi: mt76: reject out-of-range link ids in mt76_vif_link()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability occurs because the driver does not properly check the validity of link identifiers, allowing an attacker to provide an invalid identifier. This can lead to reading memory outside of its intended boundaries, which may result in information disclosure or cause the system to become unstable (denial of service).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-125 · Out-of-bounds Read