Not yet scoredPublished Sep 17, 2026

CVE-2026-90374wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

Updated under an hour ago (Oct 26, 2026, 10:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] band_idx comes from a 2-bit descriptor field (0-3) and was used directly to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the result. A corrupt or reserved descriptor value could index out of bounds or hit a NULL phy on parts with fewer bands. Reject invalid band indices, mirroring mt7996_rx_get_wcid().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	98686cd21624c75a043e96812beadddf4f6f48e5 builds before 493a029c205a994644327d554f0cfeb9651aba7c; from 98686cd21624c75a043e96812beadddf4f6f48e5 before 535091c587268cc783608642838a655d828eefdd; 98686cd21624c75a043e96812beadddf4f6f48e5 builds before 0f53ece876e1f3bbb3e18f48afc4af1ee967b16c; from 98686cd21624c75a043e96812beadddf4f6f48e5 before b1c5cf8903bec5476a2233b4e45287b9a2213e02; from 98686cd21624c75a043e96812beadddf4f6f48e5 before 2243778a5fae8329ab5f18e7adcd7e03b911a1b7	CNA record

References

References

https://git.kernel.org/stable/c/493a029c205a994644327d554f0cfeb9651aba7c
https://git.kernel.org/stable/c/535091c587268cc783608642838a655d828eefdd
https://git.kernel.org/stable/c/0f53ece876e1f3bbb3e18f48afc4af1ee967b16c
https://git.kernel.org/stable/c/b1c5cf8903bec5476a2233b4e45287b9a2213e02
https://git.kernel.org/stable/c/2243778a5fae8329ab5f18e7adcd7e03b911a1b7

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.