{"id":25788,"date":"2026-09-18T04:31:53","date_gmt":"2026-09-17T20:31:53","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90379"},"modified":"2026-09-18T04:31:53","modified_gmt":"2026-09-17T20:31:53","slug":"cve-2026-90379","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90379","title":{"rendered":"CVE-2026-90379 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: A"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash<\/p>\n<p>When an AER error occurs and the bus is hung, the register reads return<br \/>\n0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in<br \/>\nan invalid memory access when accessing q-&gt;desc[] or q-&gt;entry[].<\/p>\n<p>Unable to handle kernel paging request at virtual address<br \/>\nffffffc01099eac0<br \/>\npc : mt76_dma_add_buf+0x124\/0x188 [mt76]<br \/>\nlr : mt76_dma_rx_fill+0x11c\/0x1d8 [mt76]<br \/>\nsp : ffffffc016d9bbf0<br \/>\nx29: ffffffc016d9bc10 x28: 0000000000000000<br \/>\nx27: 0000000000000000 x26: ffffffb7855e50b8<br \/>\nx25: ffffffb80d04f000 x24: 0000000000000000<br \/>\nx23: 0000000000000ec0 x22: ffffffb796803648<br \/>\nx21: ffffffb796801f80 x20: ffffffb7968035f8<br \/>\nx19: 0000000000000ec0 x18: 0000000000000000<br \/>\nx17: 000000004ec00000 x16: 000000000ec00000<br \/>\nx15: ffffffc01099eac0 x14: 000000004ec00000<br \/>\nx13: 00000000ffc5a000 x12: ffffffc016d9bc32<br \/>\nx11: 00000000ffffffff x10: 0000000000000002<br \/>\nx9 : 0000000000000000 x8 : 000000000000b4ac<br \/>\nx7 : 0000000000000a20 x6 : ffffffb6c1806400<br \/>\nx5 : 0000000000000000 x4 : ffffffb80d04f000<br \/>\nx3 : 0000000000000000 x2 : 0000000000000001<br \/>\nx1 : 000000000ec04000 x0 : ffffffb7968035f8<br \/>\nCall trace:<br \/>\n mt76_dma_add_buf+0x124\/0x188 [mt76 (HASH:1029 4)]<br \/>\n mt76_dma_rx_reset+0xe8\/0xfc [mt76 (HASH:1029 4)]<br \/>\n mt7921_wpdma_reset+0x188\/0x1b0 [mt7921e (HASH:ee48 5)]<br \/>\n mt7921e_mac_reset+0x128\/0x418 [mt7921e (HASH:ee48 5)]<br \/>\n mt7921_mac_reset_work+0xac\/0x1a8 [mt7921_common (HASH:f721 6)]<br \/>\n process_one_work+0x188\/0x514<br \/>\n worker_thread+0x12c\/0x300<br \/>\n kthread+0x140\/0x1fc<br \/>\n ret_from_fork+0x10\/0x30<\/p>\n<p>Fix the invalid memory access by validating the DMA index read from the<br \/>\nhardware before it is used as a queue index. An out-of-range value, such<br \/>\nas the 0xFFFFFFFF returned while the bus is hung, is now clamped so it can<br \/>\nno longer corrupt q-&gt;head or q-&gt;tail. In addition, check the bus_hung flag<br \/>\nin mt7921_mac_reset_work() before attempting the reset sequence, reject MCU<br \/>\nmessages while the bus is hung, and install no-op bus operations when an<br \/>\nunrecoverable AER error is detected, preventing further invalid hardware<br \/>\naccesses.<\/p>\n<p>Due to hardware limitations &#8211; such as the lack of a connected hardware<br \/>\nreset pin or the absence of host re-probe functionality &#8211; affected Wi-Fi<br \/>\ndevices may not fully recover to a normal operational state after<br \/>\ncertain errors, even with AER enabled.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash<\/p>\n<p>When an AER error occurs and the bus is hung, the registe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25788","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}