https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 05:34:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90350 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mt76: reject out-of-range link ids in mt76_vif_link()</p> <p>mt76_vif_link() indexes mvif-&gt;link[] without validating link_id, but callers pass mvif-&gt;deflink_id / msta-&gt;deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.</p> <p>Reachable via mt7996_set_tsf()/mt7996_offset_tsf() and mt7996_net_fill_forward_path(). Bounds check link_id and return NULL, matching mt7996_sta_link() and mt7996_sta_link_protected().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mt76: reject out-of-range link ids in mt76_vif_link()</p> <p>mt76_vif_link() indexes mvif-&gt;link[] without validating link_id, but callers pass mvif-&gt;deflink_id / msta-&gt;deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.</p> <p>Reachable via mt7996_set_tsf()/mt7996_offset_tsf() and mt7996_net_fill_forward_path(). Bounds check link_id and return NULL, matching mt7996_sta_link() and mt7996_sta_link_protected().</p> https://vulnerability.circl.lu/vuln/cve-2026-90350