CVE-2026-90379

A flaw was found in the Linux kernel's Wi-Fi driver (mt76). This vulnerability occurs when a PCIe Advanced Error Reporting (AER) error causes the bus to become unresponsive. The driver then attempts to read registers, receiving an invalid value that corrupts its internal memory management. This corruption leads to an invalid memory access, which can cause the system to crash, resulting in a denial of service.

mt76 mt7921 PCIe AER handling can leave the driver reading 0xffffffff from MMIO registers while the bus is hung. That value can be used as a DMA queue index and can corrupt q head or q tail, leading to out of range access to q desc or q entry and a kernel crash. For the CVSS the PR:L is used for the paranoid score because a reduced privilege local process with delegated device or network control may be able to drive reset and recovery paths, but reliable generation of a PCIe AER bus hung condition is environment dependent. The issue is not directly reachable from normal Wi-Fi packet traffic and usually depends on local hardware error conditions or privileged fault injection. Impact is at least denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.