CVE-2026-90382

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90382
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90382.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90382
Downstream
Published
2026-09-17T16:09:19Z
Modified
2026-09-18T03:48:38Z
Summary
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a corrupted frame can report a length larger than the received buffer. The bounds check correctly discards such frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage frame taints the kernel, and panics it on the first such frame when panic_on_warn is set.

Drop the WARN and discard the frame silently, matching what commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx status and rx path") did for the neighboring rx and tx status paths.

Observed immediately on rx with an MT7612U in fcsfail monitor mode on a busy channel.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90382.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7bc04215a66b60e198aecaee8418f6d79fa19faa
Fixed
61b1f6d92249bc34580ff19de7c69c805f82adca
Fixed
c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe
Fixed
d55e7aede542c4c76ead82d37d0c112f21eb2ac2
Fixed
b6e7958602bd1acdb8ae92703b6689a28bcc9bc0
Fixed
2d31e332c13b1db7745a7bd9cf74bc105524bcac
Fixed
17d6b89e09eac2d90272fceeba3644e92212e02f
Fixed
6def491fe9c4e83aa8cba62d74e9d4ab751ee967
Fixed
81497634d9f872fd3e8b03aada55574afff6f174

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90382.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.16.0
Fixed
5.10.270
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.221
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.157
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90382.json"