In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss If a peer's… (CVE-2026-90372)
A vulnerability in the Linux kernel's mt76 wireless driver for the mt7915 chipset could cause an NSS underflow condition. This occurs if a peer's VHT/HE MCS map indicates no supported spatial streams, leading to an invalid value being written into firmware beamforming fields. The issue has been resolved by clamping the NSS value to zero.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel mt76 driver for the mt7915 wireless chipset arises when the peer's VHT/HE MCS map has no supported spatial streams (all fields set to 0x3). This causes the loop to exit with NSS (number of spatial streams) equal to zero, and the function mt7915_mcu_get_sta_nss returns (u8)-1 (255). This invalid value is then written into the firmware's sta_rec_bf beamforming fields, potentially causing incorrect behavior. The fix clamps the NSS result to zero to avoid this underflow condition.
Potential Impact
The vulnerability does not affect confidentiality but can impact integrity and availability, as indicated by the CVSS vector (C:N/I:L/A:H). The incorrect NSS value written to firmware could lead to improper beamforming behavior, potentially causing denial of service or degraded wireless performance. There are no known exploits in the wild.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to resolve the issue. Since no vendor advisory or patch links are provided, check the Linux kernel release notes or trusted sources for the relevant fixed kernel versions. No additional mitigation is indicated.
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss If a peer's… (CVE-2026-90372)
Description
A vulnerability in the Linux kernel's mt76 wireless driver for the mt7915 chipset could cause an NSS underflow condition. This occurs if a peer's VHT/HE MCS map indicates no supported spatial streams, leading to an invalid value being written into firmware beamforming fields. The issue has been resolved by clamping the NSS value to zero.
CVSS v3.1
Score 7.1high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel mt76 driver for the mt7915 wireless chipset arises when the peer's VHT/HE MCS map has no supported spatial streams (all fields set to 0x3). This causes the loop to exit with NSS (number of spatial streams) equal to zero, and the function mt7915_mcu_get_sta_nss returns (u8)-1 (255). This invalid value is then written into the firmware's sta_rec_bf beamforming fields, potentially causing incorrect behavior. The fix clamps the NSS result to zero to avoid this underflow condition.
Potential Impact
The vulnerability does not affect confidentiality but can impact integrity and availability, as indicated by the CVSS vector (C:N/I:L/A:H). The incorrect NSS value written to firmware could lead to improper beamforming behavior, potentially causing denial of service or degraded wireless performance. There are no known exploits in the wild.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to resolve the issue. Since no vendor advisory or patch links are provided, check the Linux kernel release notes or trusted sources for the relevant fixed kernel versions. No additional mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-934p-6j28-7ggx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90372"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade51e55bf5e2cf5edc162
Added to database: 09/19/2026, 01:27:58 UTC
Last enriched: 09/19/2026, 01:47:51 UTC
Last updated: 09/19/2026, 01:47:51 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.