From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFB304FC34C for ; Thu, 17 Sep 2026 16:28:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662497; cv=none; b=aaYuBod83sQm1CI7UT+KewlQTEjN5JPUHtywxnwBRqfep2Kr4hfvtpY2VadP88EFGDAWs27TVfLCnmH6MmEFfZI8QDH+HMMdTaSGH3o7AOyKTTYiqRsqW1yizez52KTnViFtaRdxtxoz/h2aoctxucfHO1PnpLj8RiWN8j2RtOM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662497; c=relaxed/simple; bh=+3bu6mX2flZt8s2Dr10/bFLNLQ3QqQTH1uLs9FZKqGA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iZONKm8WaHCDFT6Pv8eJJItZZzHjR+FFwBmMn6lmwfxD9DzBpsvpAirAvVnT9VvKAYqBmOmg5yNRswSuzW4WXdg/p7dw8CcHgi/CdY8hHZ3ztvyg+FYEiH5HqSfdWWgMyaeXWhylBZs6P55RO5NY5LFZ4qZflthGoaSqHos+nFE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=izDCDzAz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="izDCDzAz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 353961F00893; Thu, 17 Sep 2026 16:28:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662495; bh=0iXEGLOcyXv2qRyo6yeuUEZ5SX4h8/YOT2zKL4S/Fak=; h=From:To:Cc:Subject:Date:Reply-To; b=izDCDzAzN9+zDtA+DiS9cabd4Eqox8jApVWer71w79ftAMeqox4BQlDxTuM15UZ5f Tx+JVJ4lGCb0YldbxaxzQeKEdQEwXaK5vPa/EZhtw/TtavCvCXyIpneCPC5qCpXDoB lTqJSLLKAivDrbsTVdTM0qnMDbfa20SL+xgSeLiE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90374: wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] Date: Thu, 17 Sep 2026 17:13:24 +0100 Message-ID: <2026091709-CVE-2026-90374-ea5b@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2583; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=tdMgxNf6G45EuAP92JbBEsce/VISN6gkcldkomtbglw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBJa+OrnpueDhGSeebuD/a12iEPCVVeLnQd7q/RX7D weLdP3y7YhlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJ3NRmmB+8f4v5WwGpqXMW LH3OG3DcUyKUnZthwcXdz2VfpVw/yhYpvuZ0mISv2uxb1gA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] band_idx comes from a 2-bit descriptor field (0-3) and was used directly to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the result. A corrupt or reserved descriptor value could index out of bounds or hit a NULL phy on parts with fewer bands. Reject invalid band indices, mirroring mt7996_rx_get_wcid(). The Linux kernel CVE team has assigned CVE-2026-90374 to this issue. Affected and fixed versions =========================== Issue introduced in 6.2 with commit 98686cd21624c75a043e96812beadddf4f6f48e5 and fixed in 6.12.110 with commit 535091c587268cc783608642838a655d828eefdd Issue introduced in 6.2 with commit 98686cd21624c75a043e96812beadddf4f6f48e5 and fixed in 6.18.52 with commit 0f53ece876e1f3bbb3e18f48afc4af1ee967b16c Issue introduced in 6.2 with commit 98686cd21624c75a043e96812beadddf4f6f48e5 and fixed in 7.2.6 with commit b1c5cf8903bec5476a2233b4e45287b9a2213e02 Issue introduced in 6.2 with commit 98686cd21624c75a043e96812beadddf4f6f48e5 and fixed in 7.3-rc1 with commit 2243778a5fae8329ab5f18e7adcd7e03b911a1b7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90374 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/mediatek/mt76/mt7996/mac.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/535091c587268cc783608642838a655d828eefdd https://git.kernel.org/stable/c/0f53ece876e1f3bbb3e18f48afc4af1ee967b16c https://git.kernel.org/stable/c/b1c5cf8903bec5476a2233b4e45287b9a2213e02 https://git.kernel.org/stable/c/2243778a5fae8329ab5f18e7adcd7e03b911a1b7