Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

roc_abort_sync() can deadlock with roc_work(). roc_work() holds
dev->mt76.mutex, while cancel_work_sync() waits for roc_work()
to finish. If the caller already owns the same mutex, both
sides block and no progress is possible.

This deadlock can occur during station removal when
mt76_sta_state() -> mt76_sta_remove() ->
mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() ->
mt7925_roc_abort_sync() invokes cancel_work_sync() while
roc_work() is still running and holding dev->mt76.mutex.

This avoids the mutex deadlock and preserves exactly-once
work ownership.
Published: 2026-06-24
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A deadlock can occur in the Linux mt7925 Wi‑Fi driver when the function that aborts a station removal operation holds a mutex that is also owned by a worker that is executed in parallel. If both sides wait for each other, no progress is possible and the driver can freeze, leading to a loss of connectivity. This is an instance of a hard‑coded race condition that can interrupt service availability. The vulnerability is characterized by synchronization failure identified in CWE‑749.

Affected Systems

Linux kernel distributions that ship the mt7925 driver without the applied patch. The exact affected kernel versions are not listed, but any device using the mt7925 network interface card and running an older kernel that contains the unpatched mt7925 driver is susceptible. This includes a range of consumer‑grade Wi‑Fi adapters and embedded systems that rely on the kernel’s mt76 subsystem.

Risk and Exploitability

The CVSS score is not reported and EPSS is not available, so the quantitative severity is unknown; however, the fix was released publicly, suggesting the issue was considered significant enough to warrant a patch. The development trace shows commits that correct the deadlock, implying that exploitation would only be possible on kernels that have not yet incorporated these changes. The likely attack vector is local or remote network traffic that triggers station removal (e.g., management frames), but detailed exploitation mechanics are not disclosed in the available data. In any case, the vulnerability’s impact is service disruption, and once triggered it can potentially hold the entire Wi‑Fi stack hostage until the device is rebooted.

Generated by OpenCVE AI on June 24, 2026 at 19:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the mt7925 driver patch from commit 153bcba36c87a1ba555b57b6c49028d5812f895b, which removes the deadlock.
  • Reboot the device after applying the update to ensure the new driver configuration takes effect.
  • Verify Wi‑Fi service stability by connecting and disconnecting stations to confirm that no further hangs occur during station removal.

Generated by OpenCVE AI on June 24, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() -> mt7925_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership.
Title wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-24T16:30:39.184Z

Reserved: 2026-06-09T07:44:35.385Z

Link: CVE-2026-53103

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T20:00:10Z

Weaknesses

No weakness.