CVE-2026-90377
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only polls skbs queued on the MT_RXQ_RRO_IND list; frames queued under the data queue id are left sitting on that list until the data queue NAPI happens to run, stalling and reordering RX data.
Affected versions
Linux kernel versions
6.18
and later are affected. Fixed in
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-90377?
CVE-2026-90377 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.18 onward and has been patched in 6.18.52, 7.2.6 and 7.3-rc1. CVE-2026-90377 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-90377?
Yes. CVE-2026-90377 has been patched. Fixed versions include 6.18.52, 7.2.6 and 7.3-rc1. If you are running Linux kernel 6.18 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-90377 actively exploited?
No. CVE-2026-90377 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.