Out-of-bounds read in Linux kernel - CVE-2026-90374

Vulnerability details

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an array index in the mt7996_mac_fill_rx RX handler when processing a received descriptor with a corrupt or reserved band index. A remote attacker can supply a received descriptor with a corrupt or reserved band index to cause an out-of-bounds memory access.

Affected software

How to mitigate CVE-2026-90374

External References

• https://git.kernel.org/stable/c/0f53ece876e1f3bbb3e18f48afc4af1ee967b16c
• https://git.kernel.org/stable/c/2243778a5fae8329ab5f18e7adcd7e03b911a1b7
• https://git.kernel.org/stable/c/535091c587268cc783608642838a655d828eefdd
• https://git.kernel.org/stable/c/b1c5cf8903bec5476a2233b4e45287b9a2213e02

Related Security Bulletins

• Out-of-bounds read in Linux kernel mt76 mt7996 driver