Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-90374 Details

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] band_idx comes from a 2-bit descriptor field (0-3) and was used directly to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the result. A corrupt or reserved descriptor value could index out of bounds or hit a NULL phy on parts with fewer bands. Reject invalid band indices, mirroring mt7996_rx_get_wcid().

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://git.kernel.org/stable/c/0f53ece876e1f3bbb3e18f48afc4af1ee967b16c	kernel.org
https://git.kernel.org/stable/c/2243778a5fae8329ab5f18e7adcd7e03b911a1b7	kernel.org
https://git.kernel.org/stable/c/535091c587268cc783608642838a655d828eefdd	kernel.org
https://git.kernel.org/stable/c/b1c5cf8903bec5476a2233b4e45287b9a2213e02	kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes