Strix
64.3K

CVE-2026-90357

HIGHCVSS 8.8/10

Last modified

CVE-2026-90357 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks..

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 3782b69d03e714b8ff98b84c7426d8cef0e64d7c, < c09d1b15ed2dc49060303b16a296b7b8b7794cbe; >= 3782b69d03e714b8ff98b84c7426d8cef0e64d7c, < 1bd5c4ed2b9045faf83315c54cd37a9b7c71b5c7; >= 3782b69d03e714b8ff98b84c7426d8cef0e64d7c, < cabe239e95b4eebf5b6c3654087b66ff9425bc7b; >= 3782b69d03e714b8ff98b84c7426d8cef0e64d7c, < 6bce0f1280c94af8314f895f404629da09f0788c; >= 3782b69d03e714b8ff98b84c7426d8cef0e64d7c, < beaa42b875965dbc3e80e46970e0bfa60a94c2db; >= 3782b69d03e714b8ff98b84c7426d8cef0e64d7c, < 16a04441eab0dcd4d7126a6f66b370adbf28f96d
LinuxLinux5.16

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-90357?
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks.
How severe is CVE-2026-90357?
CVE-2026-90357 has a CVSS score of 8.8/10 (HIGH severity).
How do I fix CVE-2026-90357?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-90357?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST