CVE-2026-90373

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

mt7915_remove_interface() cleared the wcid mask bit with no lock held and

before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared

with the allocators, which all run under dev->mt76.mutex; on DBDC the two

wiphys share one mt76_dev, so this raced add_interface/sta_add on the

other band and could leak or double-hand-out a wcid. Clearing the bit

before the RCU pointer also let a concurrent allocation reuse the index

and publish its wcid, which the subsequent NULL assignment then wiped.

Move the clear into the existing mutex section, after the RCU pointer is

cleared.