{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: reject out-of-range link ids in mt76_vif_link()  mt76_vif_link() indexes mvif-\u003elink[] without validating link_id, but callers pass mvif-\u003edeflink_id / msta-\u003edeflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.  Reachable via mt7996_set_tsf()/mt7996_offset_tsf() and mt7996_net_fill_forward_path(). Bounds check link_id and return NULL, matching mt7996_sta_link() and mt7996_sta_link_protected().",
  "id": "DEBIAN-CVE-2026-90350",
  "modified": "2026-09-18T04:47:33.428449267Z",
  "published": "2026-09-17T17:17:33.810Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90350"
    }
  ],
  "upstream": [
    "CVE-2026-90350"
  ]
}