CVE-2026-90355

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: clear stale link state on full reset

After a full chip reset, mac80211 reconfig replays interface, link and

channel context setup. mt7996_vif_link_add() short-circuits when the

link_id is still marked in mvif->valid_links, a state introduced for

postponing link teardown to interface removal. The reset path frees the

link structures without clearing those bits, so the replayed setup never

re-creates dev_info/bss_info/STA records in the restarted firmware and

never re-registers the link wcid, leaving the device inoperative.

The reset path also leaks every allocated MLD index: per-link indices

and the per-vif group/remap indices are re-allocated from scratch during

reconfig, but the old bits stay set in the masks, so repeated full

resets exhaust the index space.

Clear valid_links in the reset vif iterator and reset the MLD index

masks alongside the existing omac_mask clearing.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References