---
cve: "CVE-2026-90380"
severity: "HIGH"
cvss: 8.8
epss: "0.3%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-17 17:17:37"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T09:22:37+02:00"
---

# CVE-2026-90380

> 8.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

A use-after-free issue occurs in mt76_rx_poll_complete due to a race
condition. The STA has already been removed, but the rx_status still
had a pointer to the wcid in the STA.

Set the links' wcid pointers to be NULL for a MLD in
mt7925_sta_pre_rcu_remove()

BUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470
Call trace:
dump_backtrace+0xec/0x128
show_stack+0x18/0x28
dump_stack_lvl+0x40/0xc8
print_report+0x1b8/0x710
kasan_report+0xe0/0x144
do_bad_area+0x120/0x260
do_tag_check_fault+0x20/0x34
do_mem_abort+0x54/0xa8
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x40/0xcc
el1h_64_sync+0x7c/0x80
mt76_rx_poll_complete+0x280/0x470
mt76_dma_rx_poll+0x114/0x51c
mt792x_poll_rx+0x60/0xf8
napi_threaded_poll_loop+0xe0/0x450
napi_threaded_poll+0x80/0x9c
kthread+0x11c/0x158
ret_from_fork+0x10/0x20

## CVSS-Vektor

```
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Benachbart | warn |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.12.110
- Kernel ≥ 7.2.6

## Referenzen

- <https://git.kernel.org/stable/c/aaf414bf81ab4b680580871784b0b929818188eb>
- <https://git.kernel.org/stable/c/b250943f3f8351385a17972bda001664a5c51008>
- <https://git.kernel.org/stable/c/217f9e7bb02558759be9d9ecfe532e9708741c50>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-90380) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_