Use-after-free in Linux kernel - CVE-2026-90368

Vulnerability details

The vulnerability allows a local user to dereference a stale monitor_vif pointer.

The vulnerability exists due to use-after-free in mt7915_add_interface() when mt76_wcid_alloc() fails during interface addition. A local user can trigger a failed interface addition to dereference a stale monitor_vif pointer.

mac80211 does not call remove_interface() when interface addition fails.

Affected software

How to mitigate CVE-2026-90368

External References

• https://git.kernel.org/stable/c/218fdf0fcb796b8d281dbdd4a6144c5a8fc7fd0f
• https://git.kernel.org/stable/c/2fb6480c52f611338e1b0abe5e6219be1fc9ab75
• https://git.kernel.org/stable/c/507eddb8175a67df5086354b92d6a4fd7f6f1f96
• https://git.kernel.org/stable/c/71bf9de2ab3fb2c54bedb0b4c9b468d2e1d55280

Related Security Bulletins

• Use-after-free in Linux kernel mt76 mt7915 driver