CVE-2026-90371

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability is a race condition that occurs during the recycling of RXDMAD_C buffers. These buffers are associated with different Network Adapter Programming Interface (NAPI) instances, and a direct recycling method can lead to a timing conflict. This race condition could result in unpredictable system behavior or instability.

A buffer recycling race exists in the mt76 RX path because RXDMAD_C buffers come from RRO data queue page pools that are owned by a different NAPI context. Direct page pool recycling from the wrong NAPI context can race the owning NAPI and may corrupt page pool lifetime assumptions for RX buffers. A nearby attacker may be able to influence the vulnerable path by sending wireless traffic to an affected MediaTek mt76 device with WED RRO RXDMAD_C enabled. For the CVSS the PR:N is used because triggering does not require a local account on the target when the affected wireless receive path is reachable over the adjacent network. The realistic impact is denial of service via kernel crash or network device failure. The paranoid impact is raised because a page pool recycling race can plausibly become a use after free or memory corruption condition, even if reliable privilege escalation is not proven from the patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.