CVE-2026-90379

Status: UPDATED  |  Advisory ID: CVE-2026-90379

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash

When an AER error occurs and the bus is hung, the register reads return

0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in

an invalid memory access when accessing q->desc[] or q->entry[].

Unable to handle kernel paging request at virtual address

ffffffc01099eac0

pc : mt76_dma_add_buf+0x124/0x188 [mt76]

lr : mt76_dma_rx_fill+0x11c/0x1d8 [mt76]

sp : ffffffc016d9bbf0

x29: ffffffc016d9bc10 x28: 0000000000000000

x27: 0000000000000000 x26: ffffffb7855e50b8

x25: ffffffb80d04f000 x24: 0000000000000000

x23: 0000000000000ec0 x22: ffffffb796803648

x21: ffffffb796801f80 x20: ffffffb7968035f8

x19: 0000000000000ec0 x18: 0000000000000000

x17: 000000004ec00000 x16: 000000000ec00000

x15: ffffffc01099eac0 x14: 000000004ec00000

x13: 00000000ffc5a000 x12: ffffffc016d9bc32

x11: 00000000ffffffff x10: 0000000000000002

x9 : 0000000000000000 x8 : 000000000000b4ac

x7 : 0000000000000a20 x6 : ffffffb6c1806400

x5 : 0000000000000000 x4 : ffffffb80d04f000

x3 : 0000000000000000 x2 : 0000000000000001

x1 : 000000000ec04000 x0 : ffffffb7968035f8

Call trace:

mt76_dma_add_buf+0x124/0x188 [mt76 (HASH:1029 4)]

mt76_dma_rx_reset+0xe8/0xfc [mt76 (HASH:1029 4)]

mt7921_wpdma_reset+0x188/0x1b0 [mt7921e (HASH:ee48 5)]

mt7921e_mac_reset+0x128/0x418 [mt7921e (HASH:ee48 5)]

mt7921_mac_reset_work+0xac/0x1a8 [mt7921_common (HASH:f721 6)]

process_one_work+0x188/0x514

worker_thread+0x12c/0x300

kthread+0x140/0x1fc

ret_from_fork+0x10/0x30

Fix the invalid memory access by validating the DMA index read from the

hardware before it is used as a queue index. An out-of-range value, such

as the 0xFFFFFFFF returned while the bus is hung, is now clamped so it can

no longer corrupt q->head or q->tail. In addition, check the bus_hung flag

in mt7921_mac_reset_work() before attempting the reset sequence, reject MCU

messages while the bus is hung, and install no-op bus operations when an

unrecoverable AER error is detected, preventing further invalid hardware

accesses.

Due to hardware limitations - such as the lack of a connected hardware

reset pin or the absence of host re-probe functionality - affected Wi-Fi

devices may not fully recover to a normal operational state after

certain errors, even with AER enabled. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References