CVE-2026-90369

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. The mt76_mmio_write_copy() and mt76_mmio_read_copy() functions, which handle memory-mapped I/O (MMIO) operations, can perform out-of-bounds reads or writes. This occurs when the data length is not a multiple of four, leading to memory access beyond the intended buffer. This vulnerability could result in information disclosure or a denial of service.

An out-of-bounds access exists in the mt76 MMIO copy helpers because the old loop rounded len up to a 4 byte boundary. For write_copy this can read 1 to 3 bytes past the source buffer and send adjacent kernel data to device registers. For read_copy this can write 1 to 3 bytes past the destination buffer with data read from MMIO, which is a kernel memory corruption primitive. For the CVSS the PR:N is used in the paranoid score because a Wi-Fi adjacent attacker may not need local privileges if an untrusted radio or firmware controlled path can drive an odd length MMIO copy. The issue is not a normal Internet remote bug. Practical exposure is more likely adjacent Wi-Fi or device mediated and must be confirmed by call site review. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.