CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
An out-of-bounds array access in the mt7996 WiFi driver can cause a kernel crash or leak memory when handling unspecified link IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90349?
CVE-2026-90349 is a memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
When mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[], mvif->mt76.link[] and sta->link[], all of which hold IEEE80211_MLD_MAX_NUM_LINKS (15) entries.
Clamp the primary link id to the default link before using it, and use the clamped value for the link_sta fallback as well.
Which versions are affected by CVE-2026-90349?
How do I fix CVE-2026-90349?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90349 being exploited?
There is no known exploitation of CVE-2026-90349 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-90349, DEBIAN-CVE-2026-90349, GHSA-763f-7f65-3wmx, UBUNTU-CVE-2026-90349.