CVE-2026-90353

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability arises from a use-after-free error in the external PHY (physical layer) registration error path. When the main PHY initialization fails after the external PHY has been registered, the external PHY hardware is prematurely freed while still registered with the mac80211 subsystem. A local attacker could potentially exploit this flaw to cause system instability (denial of service) or, in some scenarios, achieve arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.