CVE-2026-53101 - Vulnerability Details

- wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync

roc_abort_sync() can deadlock with roc_work(). roc_work() holds
dev->mt76.mutex, while cancel_work_sync() waits for roc_work()
to finish. If the caller already owns the same mutex, both
sides block and no progress is possible.

This deadlock can occur during station removal when
mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() ->
mt7921_roc_abort_sync() invokes cancel_work_sync() while
roc_work() is still running and holding dev->mt76.mutex.

This avoids the mutex deadlock and preserves exactly-once
work ownership.

Published: 2026-06-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a potential deadlock in the mt7921 Wi‑Fi driver for Linux systems. A race between the mt7921_roc_abort_sync roc_work() handler can cause both to wait on the same mutex, resulting in a stand‑still. This is an example of improper synchronization (CWE‑833) and results only in a denial of wireless connectivity; it does not directly compromise confidentiality or integrity.

Affected Systems

The flaw affects any Linux kernel that contains the mt76 driver family for MediaTek MT7921 Wi‑Fi chips. No specific kernel release numbers are listed, so the commit that introduced the fix is potentially vulnerable.

Risk and Exploitability

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the deadlock can be triggered by a local attacker with privileged access who initiates station removal while the driver is performing cleanup. Exploitation would cause the driver to block indefinitely, rendering the network interface unusable until a reboot or driver reload.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`352d966126e66d825244f1185eb9f2d904c83dd4`	affected	< b4faaa617af3f4173e64169b0ec1af8f9c5bca10
`352d966126e66d825244f1185eb9f2d904c83dd4`	affected	< 35180c772f5e11e2fa4d80d3dfd50906cb6d9646
`352d966126e66d825244f1185eb9f2d904c83dd4`	affected	< 91e77840bf13de3add125060cf8b32ca24a52c8c
`352d966126e66d825244f1185eb9f2d904c83dd4`	affected	< d5059e52fd8bc624ec4255c9fa01a266513d126b

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.95`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[352d966126e66d825244f1185eb9f2d904c83dd4,35180c772f5e11e2fa4d80d3dfd50906cb6d9646)`	affected	code_commit	—
`[352d966126e66d825244f1185eb9f2d904c83dd4,91e77840bf13de3add125060cf8b32ca24a52c8c)`	affected	code_commit	—
`[352d966126e66d825244f1185eb9f2d904c83dd4,d5059e52fd8bc624ec4255c9fa01a266513d126b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to the latest Linux kernel that includes the commit fixing the deadlock (refer to the provided git commit URLs).
If a standard package update is not yet available, apply the patch from commit 35180c772f5e11e2fa4d80d3dfd50906cb6d9646 to your kernel source and rebuild the kernel.
After updating or patching, reboot the system or restart the network interface to ensure the driver is re‑initialized without the deadlock.

Generated by OpenCVE AI on June 27, 2026 at 04:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6381-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/35180c772f5e11e2fa4d80d3dfd50906cb6d9646
https://git.kernel.org/stable/c/91e77840bf13de3add125060cf8b32ca24a52c8c
https://git.kernel.org/stable/c/b4faaa617af3f4173e64169b0ec1af8f9c5bca10
https://git.kernel.org/stable/c/d5059e52fd8bc624ec4255c9fa01a266513d126b
https://lore.kernel.org/linux-cve-announce/2026062411-CVE-2026-53101-1a11@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53101
https://www.cve.org/CVERecord?id=CVE-2026-53101

History

Sat, 04 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b4faaa617af3f4173e64169b0ec1af8f9c5bca10

Sat, 27 Jun 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-872

Sat, 27 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026062411-CVE-2026-53101-1a11@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53101 https://www.cve.org/CVERecord?id=CVE-2026-53101
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 24 Jun 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-872

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() -> mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership.
Title		wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/35180c772f5e11e2fa4d80d3dfd50906cb6d9646 https://git.kernel.org/stable/c/91e77840bf13de3add125060cf8b32ca24a52c8c https://git.kernel.org/stable/c/d5059e52fd8bc624ec4255c9fa01a266513d126b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:30:37.871Z

Updated: 2026-07-04T11:50:50.214Z

Reserved: 2026-06-09T07:44:35.384Z

Link: CVE-2026-53101

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53101 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-27T04:30:11Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object