CVE-2026-90370

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mt7996 mcu get chip config function within the mt76 wifi driver. The response Type-Length-Value (TLV) loop advances by the tlv->len value without a minimum threshold, which could allow a firmware response containing a zero-length TLV to cause an infinite loop, resulting in a CPU hang during device probe. Additionally, the u32 payload is read without proper bounds checking. TLV is a common encoding scheme used to encapsulate data in a format that is easy to parse.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.