{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-90371", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-90371" ], "published": "2026-09-17T16:10:40Z", "summary": "wifi: mt76: fix RXDMAD_C buffer recycling race", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: fix RXDMAD_C buffer recycling race\n\nThe RXDMAD_C buffers come from the RRO data queues' page pools, which are\nbound to a different NAPI, so the direct page-pool recycle used here could\nrace the owning NAPI; take the non-direct path as is already done for WED\nRX queues.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.52" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.52" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.52" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.52" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.52" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90371" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/7ac05ed3a50e511c93f8506e555709a208dfce0a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a273dc3b86a7d983d643827d3d3c795d55d8f632" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/e1f97c10a4ec2b9db69a134b757304399ca903ce" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-18T17:55:42Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.8, "cvss_v3_severity": "High", "scenario": "AV:A - Received 802.11 frames are completed by HW-RRO v3.1 into the RXDMAD_C ring; mt7996_irq_handler/mt7996_irq_tasklet schedules napi[MT_RXQ_RRO_RXDMAD_C] and mt76_dma_rx_poll\u2192mt76_dma_rx_process\u2192mt76_dma_get_rxdmad_c_buf recycles those payload pages. A radio-range peer supplies the frames; WiFi is adjacent, not a routable IP transport.\nAC:L - The attacker drives both NAPIs by flooding 802.11 traffic: the RRO data-queue NAPI runs mt76_dma_rx_fill\u2192page_pool_alloc_frag on the owning pool, while RXDMAD_C drops completions (SDL0 vs SKB_WITH_OVERHEAD of MT7996_RX_BUF_SIZE, or extra frags in mt76_add_fragment) and calls mt76_put_page_pool_buf(..., true) into the same unlocked alloc.cache.\nPR:N - mt76_dma_get_rxdmad_c_buf runs on the WiFi RX DMA completion path with no host credential check; a nearby unauthenticated station can send frames that HW-RRO v3.1 writes into RXDMAD_C (rx_token_id/SDL0) without any kernel account.\nUI:N - With the mt7996/mt7992 interface already up in HWRRO v3.1, the attacker triggers mt76_dma_rx_process on MT_RXQ_RRO_RXDMAD_C solely by transmitting frames; no mount, click, or other victim action is required.\nS:U - The race corrupts the host kernel page_pool alloc.cache for the RRO data queues (dev->q_rx[t->qid]->page_pool) in the same kernel; it does not cross a VM, IOMMU, or guest/host boundary.\nC:H - Concurrent lockless updates of pool->alloc.cache/count in page_pool_recycle_in_cache versus page_pool_alloc_frag can issue the same RX page twice or return a stale pointer, a use-after-free of packet buffers that enables disclosure of kernel or packet memory.\nI:H - The same unlocked recycle can bump alloc.count past PP_ALLOC_CACHE_SIZE so a later page_pool_recycle_in_cache writes a netmem pointer out of bounds, and a double-issued page lets attacker-controlled 802.11 DMA clobber reused kernel memory.\nA:H - A corrupted page_pool alloc.cache yields invalid page pointers and use-after-free in mt76_dma_rx_fill/mt76_dma_rx_process, which oopses or panics the kernel." } } }