Use-after-free in Linux kernel - CVE-2026-90356
Published: September 18, 2026
Vulnerability identifier: #VU151128
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90356
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger a use-after-free condition.
The vulnerability exists due to use-after-free in the mt7996 full-reset handling code when performing a full device reset. A local user can trigger a full device reset to cause operations on freed memory.
Exploitation depends on an RCU grace period elapsing after virtual interface links are queued for freeing and before wireless client identifier cleanup occurs.
Affected software
Linux kernel
How to mitigate CVE-2026-90356
Install security update from vendor's repository.