{"cve":"CVE-2026-90354","nvd":{"published":"2026-09-17T17:17:34.260","modified":"2026-10-19T09:19:29.410","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix double hif2 init on the non-WED path\n\nmt7915_pci_init_hif2() was called unconditionally and again inside the\nWED-inactive branch. The helper increments the global hif_idx, writes the\nPCIe RECOG_ID register and takes a get_device() reference via\nmt7915_pci_get_hif2(), while removal only drops one reference. On non-WED\ndual-hif hardware this double-incremented hif_idx, wrote RECOG_ID twice and\nleaked a device reference. Only the call inside the WED-inactive branch is\ncorrect; drop the unconditional one. hif2 is already initialised to NULL.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/249cbaa1873550689fab136b74982cbba74c4169","https://git.kernel.org/stable/c/29fbc5256c2d8448f084ff179d2e5092ecd1fc54","https://git.kernel.org/stable/c/3ae8ad277e2819a281b0e36b55633c8515c16ce7","https://git.kernel.org/stable/c/927fe8c0eb8c10295bc0018c8faa4d91f8fe98c6","https://git.kernel.org/stable/c/bd2e8f535ae35beb45a7fcc17ec9bbf8dc4db5fe"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90354","score":0.00173,"percentile":0.06633,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}