CVE-2026-53101

Awaiting Analysis Awaiting Analysis - Queue

Deadlock in mt76 WiFi Driver via ROC Work

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() -> mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53101

EUVD

EUVD-2026-38969

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

This vulnerability can cause a deadlock in the Linux kernel's wifi driver, which means that certain wifi operations may hang indefinitely. This can lead to system instability or unresponsiveness related to wifi functionality, particularly during station removal processes.

Executive Summary

This vulnerability is a potential deadlock in the Linux kernel's wifi driver for the mt7921 device. Specifically, the function roc_abort_sync() can deadlock with roc_work(). The deadlock happens because roc_work() holds a mutex (dev->mt76.mutex), and cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block each other, causing no progress.

This deadlock can occur during the removal of a station when a sequence of function calls leads to mt7921_roc_abort_sync() invoking cancel_work_sync() while roc_work() is still running and holding the mutex. The fix prevents this deadlock and ensures that work ownership is preserved exactly once.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the potential deadlock in the mt7921_roc_abort_sync function. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

This update avoids the mutex deadlock and preserves exactly-once work ownership, preventing the deadlock scenario during station removal.

Hi! I’m here to help you understand CVE-2026-53101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70