CVE-2026-53104

wifi: mt76: Fix memory leak destroying device

Published Jun 24, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix memory leak destroying device

All MT76 rx queues have an associated page_pool even if the queue is not
associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the
page_pool running mt76_dma_cleanup routine during module unload.
Moreover returns pages to the page pool if WED is not enabled for WED RRO
queues.

Analysis

Technical impact

The Linux kernel contains a memory leak in the mt76 Wi‑Fi driver. Each receive queue maintains a page_pool even when it is not used for NAPI, such as certain WED RRO queues. When the module unloads, these page_pools are not destroyed, causing pages to remain allocated and the system’s free memory to shrink over time until the device is removed or the kernel becomes unstable.

Affected Systems

Any Linux kernel that compiles and loads the mt76 driver is affected. Neither the vendor nor the product scope is narrowed to a version, and no specific kernel release is mentioned. Systems that use a configuration including the mt76 module may experience the leak.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is less than 1%, with no listing in CISA's KEV catalog. The likely attack vector is local, inferred from the requirement to unload the driver module; the vulnerability does not provide remote code execution or privilege escalation. Consequently, the risk of exploitation is low, and the impact remains confined to memory availability and device stability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`950d0abb5cd94f2b0710c5c42ac4398c91a7ff22`	affected	< 3c363fc4dbdb77a3f02dcf6ba90c1f0a111ef055
`950d0abb5cd94f2b0710c5c42ac4398c91a7ff22`	affected	< dcbc13d19bef3326c72f324b10f5a3e5fc4d71de
`950d0abb5cd94f2b0710c5c42ac4398c91a7ff22`	affected	< 4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f
`950d0abb5cd94f2b0710c5c42ac4398c91a7ff22`	affected	< 6b470f36616e3448d44b0ef4b1de2a3e3a31b5be

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.114`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[950d0abb5cd94f2b0710c5c42ac4398c91a7ff22,dcbc13d19bef3326c72f324b10f5a3e5fc4d71de)`	affected	code_commit	—
`[950d0abb5cd94f2b0710c5c42ac4398c91a7ff22,4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f)`	affected	code_commit	—
`[950d0abb5cd94f2b0710c5c42ac4398c91a7ff22,6b470f36616e3448d44b0ef4b1de2a3e3a31b5be)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.8`	affected	semver	—
`[0,6.8)`	unaffected	semver	—
`[6.18.33,6.18.*]`	unaffected	semver	—
`[7.0.10,7.0.*]`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that contains the mt76 memory‑leak fix, or merge the commit history shown in the references into your source tree and rebuild the kernel.
Ensure the updated kernel or patched module is configured to load during system startup, and that any previously loaded mt76 modules are replaced.
Reboot the system to unload and reload the driver, verifying that no new memory leaks are reported after the patch.

Generated by OpenCVE AI on August 12, 2026 at 07:27 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4904-1	linux-6.12 security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.162% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/3c363fc4dbdb77a3f02dcf6ba90c1f0a111ef055
https://git.kernel.org/stable/c/4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f
https://git.kernel.org/stable/c/6b470f36616e3448d44b0ef4b1de2a3e3a31b5be
https://git.kernel.org/stable/c/dcbc13d19bef3326c72f324b10f5a3e5fc4d71de
https://lore.kernel.org/linux-cve-announce/2026062412-CVE-2026-53104-95e8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53104
https://www.cve.org/CVERecord?id=CVE-2026-53104

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3c363fc4dbdb77a3f02dcf6ba90c1f0a111ef055

Jun 27, 2026 3:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-401

Jun 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026062412-CVE-2026-53104-95e8@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53104 https://www.cve.org/CVERecord?id=CVE-2026-53104
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Jun 24, 2026 9:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-401

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak destroying device All MT76 rx queues have an associated page_pool even if the queue is not associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the page_pool running mt76_dma_cleanup routine during module unload. Moreover returns pages to the page pool if WED is not enabled for WED RRO queues.
Title		wifi: mt76: Fix memory leak destroying device
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f https://git.kernel.org/stable/c/6b470f36616e3448d44b0ef4b1de2a3e3a31b5be https://git.kernel.org/stable/c/dcbc13d19bef3326c72f324b10f5a3e5fc4d71de