{"id":"CVE-2026-90367","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-90367","summary":"wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER\n\nmt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs\nbefore taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain\nkthread park/unpark, not refcounted, and __mt76_set_channel() toggles the\nsame worker and the MT76_RESET bit under the mutex. An L1 SER racing a\nchannel switch could therefore have the worker unparked and MT76_RESET\ncleared while the reset path resets the DMA rings, corrupting descriptors\nor tokens. Take the mutex before disabling the worker, as mt7915 does.","published":"2026-09-17T16:09:09.430Z","modified":"2026-09-19T03:47:28.966457180Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.18.52"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90367.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90367"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-19T03:47:28.966457180Z"}}