Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90353— wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已修复： wifi: mt76: mt7915: 修复 ext PHY 在寄存器错误路径下的使用已释放内存（use-after-free）问题 在 调用成功后，如果主 PHY 的 或 失败，错误处理逻辑通过 进行回溯清理。该路径会调用 来释放 ext PHY 的硬件实例，但此时该实例仍注册在 mac80211 子系统中，从而导致使用已释放内存的问题。原因是 仅注销主硬件实例，未处理 ext PHY。 修复方案：在清理过程中，首先注销 ext PHY（包括 thermal、phy 和

CVSS 7.0 · High EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 7b8e1ae886e45aed9274048f2836a70b75ecfa40< aa55bec92ba7747dd08feff409f8074c5e052e71 affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40< ad706fcf6255494613b94418e7243d98065dbeaf affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40< 34058ad122f7524e33df8e38caba4b1d803b025a affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40< a7fd3bae8e11a7c00df6a5021d9ef248ae9f9bf5 affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40< 648f5f03ff50d4bd719106ace0cdf1d8be02cbdd affected
7b8e1ae886e45aed9274048f2836a70b75ecfa40< 15b960014f24dce5388d4a2e7274e6490cb3c421 affected
5.19 affected
< 5.19 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90353

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw. Unregister the ext PHY (thermal + phy + hw) first and skip the redundant free.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7b8e1ae886e45aed9274048f2836a70b75ecfa40 ~ aa55bec92ba7747dd08feff409f8074c5e052e71 -
Linux Linux 5.19 -

II. Public POCs for CVE-2026-90353

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90353

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90353 (6)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-93189 8.8 HIGH HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race
CVE-2026-90255 8.8 HIGH Bluetooth: hci_conn: fix the SCO setup context lifetime

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90353

No comments yet

Leave a comment