{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90353", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.805Z", "datePublished": "2026-09-17T16:09:00.217Z", "dateUpdated": "2026-09-18T17:54:48.057Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-18T17:54:48.057Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix ext PHY use-after-free on register error path\n\nAfter mt7915_register_ext_phy() succeeded, a failure of the main PHY\nmt7915_init_debugfs() or mt7915_coredump_register() unwound through\nfree_phy2, which called ieee80211_free_hw() on the ext PHY hw while it\nwas still registered with mac80211, since mt76_unregister_device() only\nunregisters the main hw. Unregister the ext PHY (thermal + phy + hw)\nfirst and skip the redundant free."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is in mt7915_register_device()'s free_phy2 unwind, reached only from mt7915_pci_probe() and mt798x_wmac_probe() when mt7915_init_debugfs() or mt7915_coredump_register() fails after mt7915_register_ext_phy(); no 802.11 frame or nl80211 command supplies the triggering data.\nAC:H - mt7915_init_debugfs() always returns 0, so the live branch is mt7915_coredump_register() failing its vzalloc of struct mt7915_crash_data after mt7915_alloc_ext_phy() produced phy2 (DBDC). That one-shot ENOMEM during pci/platform probe is not something an attacker can reliably force.\nPR:L - After ieee80211_free_hw() on the still-registered ext PHY, mt76_unregister_device() drops only the main hw, leaving the ext wiphy, the default STA vif from ieee80211_register_hw(), and mt7915_thermal_ops (cdev->devdata = phy) reachable via nl80211 and thermal sysfs without init-namespace root or PCI bind capability.\nUI:N - No victim must mount media or open a file; once the probe unwind runs, udev, mac80211's leftover workqueue/inetaddr notifier, or the attacker\u2019s own nl80211/thermal access touches the still-registered ext PHY.\nS:U - ieee80211_free_hw() frees the ext PHY's ieee80211_local/wiphy/sband while mac80211 still holds it; impact is host-kernel heap corruption, not a VM, IOMMU, or sandbox escape.\nC:H - ieee80211_free_hw() kfree's the ext PHY's still-registered wiphy bands and wiphy_free()s the hw while cfg80211 and mt7915_thermal_get_cur_throttle_state() still dereference that phy via cdev->devdata, a UAF read primitive.\nI:H - The leftover ext-PHY object is written by mt7915_thermal_set_cur_throttle_state() (phy->cdev_state and mt7915_mcu_set_thermal_throttling) and by mac80211 workqueues never torn down by ieee80211_unregister_hw(), enabling UAF writes and control-flow hijack.\nA:H - ieee80211_free_hw() without ieee80211_unregister_hw() leaves mac80211 workqueues, inetaddr notifiers, and the default wlan vif running against freed ieee80211_local, which oopses or panics on the next access."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7915/init.c"], "versions": [{"version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "aa55bec92ba7747dd08feff409f8074c5e052e71", "status": "affected", "versionType": "git"}, {"version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "ad706fcf6255494613b94418e7243d98065dbeaf", "status": "affected", "versionType": "git"}, {"version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "34058ad122f7524e33df8e38caba4b1d803b025a", "status": "affected", "versionType": "git"}, {"version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5", "status": "affected", "versionType": "git"}, {"version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "648f5f03ff50d4bd719106ace0cdf1d8be02cbdd", "status": "affected", "versionType": "git"}, {"version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "lessThan": "15b960014f24dce5388d4a2e7274e6490cb3c421", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7915/init.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa55bec92ba7747dd08feff409f8074c5e052e71"}, {"url": "https://git.kernel.org/stable/c/ad706fcf6255494613b94418e7243d98065dbeaf"}, {"url": "https://git.kernel.org/stable/c/34058ad122f7524e33df8e38caba4b1d803b025a"}, {"url": "https://git.kernel.org/stable/c/a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5"}, {"url": "https://git.kernel.org/stable/c/648f5f03ff50d4bd719106ace0cdf1d8be02cbdd"}, {"url": "https://git.kernel.org/stable/c/15b960014f24dce5388d4a2e7274e6490cb3c421"}], "title": "wifi: mt76: mt7915: fix ext PHY use-after-free on register error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7915/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aa55bec92ba7747dd08feff409f8074c5e052e71", "status": "affected", "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "versionType": "git"}, {"lessThan": "ad706fcf6255494613b94418e7243d98065dbeaf", "status": "affected", "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "versionType": "git"}, {"lessThan": "34058ad122f7524e33df8e38caba4b1d803b025a", "status": "affected", "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "versionType": "git"}, {"lessThan": "a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5", "status": "affected", "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "versionType": "git"}, {"lessThan": "648f5f03ff50d4bd719106ace0cdf1d8be02cbdd", "status": "affected", "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "versionType": "git"}, {"lessThan": "15b960014f24dce5388d4a2e7274e6490cb3c421", "status": "affected", "version": "7b8e1ae886e45aed9274048f2836a70b75ecfa40", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7915/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix ext PHY use-after-free on register error path\n\nAfter mt7915_register_ext_phy() succeeded, a failure of the main PHY\nmt7915_init_debugfs() or mt7915_coredump_register() unwound through\nfree_phy2, which called ieee80211_free_hw() on the ext PHY hw while it\nwas still registered with mac80211, since mt76_unregister_device() only\nunregisters the main hw. Unregister the ext PHY (thermal + phy + hw)\nfirst and skip the redundant free."}], "id": "CVE-2026-90353", "lastModified": "2026-09-18T18:17:55.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:17:34.140", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15b960014f24dce5388d4a2e7274e6490cb3c421"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34058ad122f7524e33df8e38caba4b1d803b025a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/648f5f03ff50d4bd719106ace0cdf1d8be02cbdd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa55bec92ba7747dd08feff409f8074c5e052e71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad706fcf6255494613b94418e7243d98065dbeaf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"created": "2026-09-19T05:45:06.356411+00:00", "updated": "2026-09-19T05:45:06.356417+00:00", "vendors": [], "weaknesses": ["CWE-416"]}