CVE-2026-53097: Linux MT7996 Wi-Fi Driver Use-After-Free (CVSS 7.8)

Technical summary

CVE-2026-53097 is a use-after-free (CWE-416) flaw in the mt76 driver's MT7996 chipset handler. During PCI device removal, mt7996_coredump_unregister() deallocates dev->coredump.crash_data via vfree(). Concurrently, the dump_work work-queue item may still be queued or executing, causing mt7996_mac_dump_work() to dereference the freed memory. The race condition arises because no cancel_work_sync() call ensures dump_work completion before crash_data deallocation. The fix adds explicit work cancellation in mt7996_unregister_device() to serialize the cleanup sequence.

Business impact

Systems running affected Linux kernels with MT7996-based Wi-Fi adapters face instability during driver unload or device hotplug scenarios. Exploitation could trigger kernel panics, denial of service, or—depending on heap layout and attacker position—arbitrary code execution at kernel privilege level. Organizations heavily reliant on wireless infrastructure or edge devices with these adapters should prioritize remediation to prevent operational disruption.

Affected systems

The vulnerability affects Linux kernel implementations that include the mt76 driver with MT7996 chipset support. This includes recent stable and LTS kernel versions containing the affected code path. Affected systems typically include laptops, edge computing devices, or wireless access points using Mediatek MT7996 radio modules. Desktop and server systems without MT7996 adapters are not impacted.

Exploitability

Exploitability requires local access and the ability to trigger device removal (unbind/hotplug) while a diagnostic dump is pending. The attack surface is limited to users with sufficient privileges to manipulate PCI devices or force driver unload. Public exploit code is not known; however, the vulnerability is trivial to trigger in lab conditions and does not require interaction beyond standard device management commands. The CVSS score of 7.8 (High) reflects local privilege requirements but high impact on confidentiality, integrity, and availability.

Remediation

Apply kernel patches that add cancel_work_sync() in mt7996_unregister_device() before crash_data deallocation. This ensures the dump_work workqueue item is fully canceled and synchronized before memory is freed. Verify the patch against the official Linux kernel repository or your distribution's security advisory. Users unable to patch immediately should avoid hotplugging or unloading the MT7996 driver during system operation.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing this vulnerability. When available, update to patched kernel versions through your package manager (apt, yum, dnf, etc.). Verify patches by checking commit logs in the linux-kernel repository or your vendor's security bulletins. Test in a non-production environment before deploying to production systems. Reboot is required after kernel patching.

Detection guidance

Monitor system logs for kernel oops, panic messages, or use-after-free warnings involving mt7996_mac_dump_work or coredump-related functions. Enable kernel debugging (CONFIG_DEBUG_KMEMLEAK, CONFIG_KASAN) in development/test environments to catch heap corruption earlier. Track PCI device unbind/hotplug events correlated with diagnostic dump operations. System administrators should review kernel bug reports and dmesg during driver reload cycles for warning signs.

Why prioritize this

Although CVE-2026-53097 requires local access and specific hardware (MT7996 adapters), the high CVSS score (7.8), ease of triggering, and kernel-level impact warrant prompt attention. Organizations using affected wireless hardware should patch within normal security update cycles. The lack of KEV designation suggests limited active weaponization, but the triviality of reproduction in controlled environments justifies prioritization over lower-impact flaws.

Risk score, explained

CVSS 3.1 score of 7.8 (High) reflects: attack vector Local (AV:L), attack complexity Low (AC:L), privilege requirement Low (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures kernel-level memory corruption leading to potential code execution, moderated only by the need for local access and low-level privilege. No CVSS modifiers or environmental factors alter the published score.

Frequently asked questions