---
id: CVE-2026-90368
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7915: unwind state on add_interface failure

  When mt76_wcid_alloc() fails, mt7915_add_interface() returned without
  clearing the vif_mask/omac_mask bits it…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7915: unwind state on add_interface failure

  When mt76_wcid_alloc() fails, mt7915_add_interface() returned without
  clearing the vif_mask/omac_mask bits it…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b619e01380eedf24e8d26a367e94e0ccaeb0c3dd <
    218fdf0fcb796b8d281dbdd4a6144c5a8fc7fd0f
  - >-
    Linux >= b619e01380eedf24e8d26a367e94e0ccaeb0c3dd <
    507eddb8175a67df5086354b92d6a4fd7f6f1f96
  - >-
    Linux >= b619e01380eedf24e8d26a367e94e0ccaeb0c3dd <
    71bf9de2ab3fb2c54bedb0b4c9b468d2e1d55280
  - >-
    Linux >= b619e01380eedf24e8d26a367e94e0ccaeb0c3dd <
    2fb6480c52f611338e1b0abe5e6219be1fc9ab75
  - Linux 5.19
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:35.917'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90368'
references:
  - url: 'https://git.kernel.org/stable/c/218fdf0fcb796b8d281dbdd4a6144c5a8fc7fd0f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2fb6480c52f611338e1b0abe5e6219be1fc9ab75'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/507eddb8175a67df5086354b92d6a4fd7f6f1f96'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/71bf9de2ab3fb2c54bedb0b4c9b468d2e1d55280'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.810Z'
epss: 0.00209
epssPercentile: 0.09805
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: unwind state on add_interface failure

When mt76_wcid_alloc() fails, mt7915_add_interface() returned without
clearing the vif_mask/omac_mask bits it had already set, without removing
the firmware dev info added earlier, and without clearing a monitor_vif
pointer to the vif mac80211 is about to free. mac80211 does not call
remove_interface() for a failed add, so the indices and firmware dev
entry leaked permanently and testmode could dereference the stale
monitor_vif. Add a proper error unwind.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.