linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device u...
CVE-2026-90365 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-90365, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dump_work on unregister but left reset_work and rc_work to be flushed only by destroy_workqueue() in mt76_free_device(), which runs after the hw is unregistered and the hardware stopped. A reset_work that fires in that window calls ieee80211_restart_hw() and re-arms mac_work on an unregistered hw, and rc_work touches station state being torn down. Cancel both up front, alongside dump_work.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| linux · Debian 13.5 (trixie) | 6.12.115-2 | DEBIAN-CVE-2026-90365 | Sep 23, 2026 |
| linux · Debian 14 | 7.2.6-1 | DEBIAN-CVE-2026-90365 | Sep 23, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.