CVE-2026-90375

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: fix non-AQL packet accounting for MLO stations

__mt76_tx_queue_skb() overrides the wcid passed by the driver with

sta->drv_priv, so the wcid might incorrectly be changed after TX,

causing wcid->non_aql_packets to be counted on the wrong wcid. For

example, on the AP side, if a station's setup link is the 5G link and

the station uses 2G to transmit a frame, the value of non_aql_packets

is increased on the 5G wcid but decreased on the 2G wcid. Once the

inflated counter exceeds MT_MAX_NON_AQL_PKT, the TX scheduler

permanently refuses to service the station.

Drop the reassignment and account on the wcid used for transmission.

This also records the actual wcid in the queue entry.