AZL-102923
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102923.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-102923
- Upstream
- Published
- 2026-09-17T17:17:35Z
- Modified
- 2026-09-18T14:18:03Z
- Summary
- CVE-2026-90366 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic(). Reserve room for both countdown TLVs.
- References