What’s Vulnerable › Vulnerabilities

CVE-2026-90377: wifi: mt76: fix RX data queuing of RRO 3.0

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only polls skbs queued on the MT_RXQ_RRO_IND list; frames queued under the data queue id are left sitting on that list until the data queue NAPI happens to run, stalling and reordering RX data.

Affected products

• Linux kernel: 6.18 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/62aea1d45b524cde9e02d1e7f65d2c4fd60871b8
• https://git.kernel.org/stable/c/86897f106669c07eea4c34b54c3268d448d41426
• https://git.kernel.org/stable/c/db4be207f3f6d8886f0b31f8c7db863a4b835ec1

Get alerted when CVE-2026-90377 or the next vulnerability affects your stack