Linux Kernel CVE-2026-90367

Requires a system running the Linux kernel mt76/mt7996 wireless driver on MediaTek MT7996/MT7992 (Wi-Fi 7) hardware, kernel 6.4 through the fixed versions. Exploitation depends on a narrow, non-attacker-controllable race: an L1 System Error Recovery (SER) event in mt7996_mac_reset_work() must coincide with an in-progress __mt76_set_channel() channel switch so the tx worker is unparked and the MT76_RESET bit cleared while DMA rings are being reset. The SER path is a hardware/firmware error-recovery trigger, not a normal packet-processing path, which is the primary limiting factor; there is no user interaction and no authentication step, but the timing window makes deliberate triggering impractical.

The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.8) significantly overstates real-world risk for what is fundamentally a reliability/concurrency defect. The description is explicit that this is a race condition ('An L1 SER racing a channel switch could therefore...'), which contradicts the vendor's AC:L - a Linux-driver System Error Recovery event (L1 SER) is a firmware/hardware-triggered fault path that an attacker cannot reliably schedule to coincide with an in-flight channel switch, so AC:H is more honest. The claimed C:H/I:H impact is not supported by the mechanism: the outcome is corrupted DMA descriptors or tokens, i.e. driver/DMA-ring corruption leading to crash or wedged Wi-Fi (a denial-of-service), not confidentiality or integrity compromise of data. No EPSS score, no CISA KEV listing, and no public PoC are present in the provided intelligence. SSVC-style reading: exploitation = none observed, automatable = no (requires a coincidental hardware error path), technical impact = partial (device DoS). Net: this is a high-CVSS-but-low-real-risk issue - a legitimate kernel hardening fix rather than an actively-threatening vulnerability. Note the CWE is listed as N/A; this is best characterized as CWE-662 (improper synchronization) / CWE-362 (race condition).

An attacker on the same wireless L2 segment (or local conditions that induce a hardware error) would need a mt7996-based Wi-Fi 7 device to undergo an L1 System Error Recovery event at the exact moment a channel switch is being processed, so that the tx worker is unparked and the MT76_RESET bit is cleared while the reset path is resetting DMA rings. The resulting descriptor/token corruption crashes or wedges the Wi-Fi interface (DoS). No public exploit exists and the timing is not attacker-controllable, making deliberate exploitation impractical.