CVE-2026-90367

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the mt7996 driver where the mt7996 mac reset work() function parks the tx worker and disables RX/TX NAPIs before acquiring the dev->mt76.mutex. Because mt76 worker disable() and mt76 worker enable() are not refcounted, an L1 SER (System Error Recovery) occurring simultaneously with a channel switch could result in the worker being unparked and the MT76 RESET bit being cleared while the reset path is still resetting DMA rings. This sequence can lead to the corruption of descriptors or tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.