CVE-2026-90374: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-90374DEBIAN-CVE-2026-90374
Published 17-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-90374 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.4% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.21%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11893-1

Timeline

  1. 17-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] band_idx comes from a 2-bit descriptor field (0-3) and was used directly to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the result. A corrupt or reserved descriptor value could index out of bounds or hit a NULL phy on parts with fewer bands. Reject invalid band indices, mirroring mt7996_rx_get_wcid().

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

+0.01 pp

From 0.20% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu142 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 98686cd21624c75a043e96812beadddf4f6f48e5, < 493a029c205a994644327d554f0cfeb9651aba7c | ≥ 98686cd21624c75a043e96812beadddf4f6f48e5, < 535091c587268cc783608642838a655d828eefdd | ≥ 98686cd21624c75a043e96812beadddf4f6f48e5, < 0f53ece876e1f3bbb3e18f48afc4af1ee967b16c | ≥ 98686cd21624c75a043e96812beadddf4f6f48e5, < b1c5cf8903bec5476a2233b4e45287b9a2213e02 | ≥ 98686cd21624c75a043e96812beadddf4f6f48e5, < 2243778a5fae8329ab5f18e7adcd7e03b911a1b7 | 6.2

3 vendors · 145 products

References

9 links