CVE-2026-90354 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
A double initialization bug in the mt7915 Wi-Fi driver leaks device references, potentially causing resource exhaustion and denial of service on non-WED hardware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90354?
CVE-2026-90354 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix double hif2 init on the non-WED path
mt7915_pci_init_hif2() was called unconditionally and again inside the WED-inactive branch. The helper increments the global hif_idx, writes the PCIe RECOG_ID register and takes a get_device() reference via mt7915_pci_get_hif2(), while removal only drops one reference. On non-WED dual-hif hardware this double-incremented hif_idx, wrote RECOG_ID twice and leaked a device reference. Only the call inside the WED-inactive branch is correct; drop the unconditional one. hif2 is already initialised to NULL.
Which versions are affected by CVE-2026-90354?
How do I fix CVE-2026-90354?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90354 being exploited?
There is no known exploitation of CVE-2026-90354 in the wild and no public exploit code.
Sources
Also known as AZL-102173, BELL-CVE-2026-90354, DEBIAN-CVE-2026-90354, GHSA-hm9g-hpm6-69p6, UBUNTU-CVE-2026-90354.