CVE-2026-90380

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. A use-after-free vulnerability occurs due to a race condition in the mt76_rx_poll_complete function. This can happen when a Wi-Fi station (STA) is removed, but the system still attempts to access its associated wireless client ID (wcid). An attacker could potentially exploit this to cause system instability or a denial of service.

A use after free can occur in the mt76 mt7925 Wi-Fi receive path because mt76_rx_poll_complete may still observe an rx_status wcid pointer after the related STA has already been removed. This is a race between STA removal and RX completion, and KASAN reports an invalid access in mt76_rx_poll_complete. For the CVSS the PR:N is used because an adjacent Wi-Fi peer or nearby attacker does not need local account privileges on the victim, although reliable triggering depends on wireless state transitions, timing, and affected mt7925 hardware. The attack surface is adjacent network rather than routed Internet reachability, because the trigger is tied to Wi-Fi link layer activity and station lifecycle events. Impact is at least denial of service via kernel crash, and the paranoid score treats the stale pointer as a use after free memory corruption candidate with possible confidentiality and integrity impact that should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.