In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two
bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but
MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a
near-maximum beacon template the extra 8 bytes could push the offload
command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic().
Reserve room for both countdown TLVs.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
98686cd21624c75a043e96812beadddf4f6f48e5 affected < 1d348f96623ec20d700af7d4dfc00a74da6238ac
98686cd21624c75a043e96812beadddf4f6f48e5 affected < bc1d694a1ffe0062c3adf0db1d64ad54454398ec
98686cd21624c75a043e96812beadddf4f6f48e5 affected < 45d8896e4cffffb2c6554ccbec6efe7a0d53166f
98686cd21624c75a043e96812beadddf4f6f48e5 affected < 1a51aff0e048dc5b8252d65808b79939c942d6ec
98686cd21624c75a043e96812beadddf4f6f48e5 affected < 50c66bab321140c49aa2ed779a3ec9d2f085b458
Linux Linux affected
Version Status Constraints
6.2 affected —
0 unaffected < 6.2
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1a51aff0e048dc5b8252d65808b79939c942d6ec cve-icon cve-icon
https://git.kernel.org/stable/c/1d348f96623ec20d700af7d4dfc00a74da6238ac cve-icon cve-icon
https://git.kernel.org/stable/c/45d8896e4cffffb2c6554ccbec6efe7a0d53166f cve-icon cve-icon
https://git.kernel.org/stable/c/50c66bab321140c49aa2ed779a3ec9d2f085b458 cve-icon cve-icon
https://git.kernel.org/stable/c/bc1d694a1ffe0062c3adf0db1d64ad54454398ec cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic(). Reserve room for both countdown TLVs.
Title wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:09:08.785Z

Reserved: 2026-09-11T19:38:34.807Z

Link: CVE-2026-90366

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:35.700

Modified: 2026-09-17T17:17:35.700

Link: CVE-2026-90366

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.