CVE-2026-90366

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mt7996 driver where the mt7996 mcu beacon cntdwn() function emits two bss bcn cntdwn tlv entries during an active CSA countdown, but the MT7996 BEACON UPDATE SIZE only reserves space for one. When MBSSID is enabled and a near-maximum beacon template is used, the additional 8 bytes can cause the offload command to exceed the MT7996 MAX BSS OFFLOAD SIZE, leading to a system crash via skb over panic(). CSA (Channel Switch Announcement) is a mechanism used to notify clients that the access point is changing channels.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.