CVE-2026-53098: Linux Kernel MT7915 WiFi Driver Use-After-Free Vulnerability

Technical summary

CVE-2026-53098 is a use-after-free (CWE-416) vulnerability in the MT7915 wireless driver subsystem of the Linux kernel. The vulnerability arises from a race condition between the device removal path and the mt7915_mac_dump_work() workqueue handler. When mt7915_pci_remove() invokes mt7915_unregister_device(), which calls mt7915_coredump_unregister() to free crash_data via vfree(), a concurrent dump_work item may still be queued or executing. If mt7915_mac_dump_work() runs after the crash_data pointer has been freed, it dereferences the invalid memory. The fix adds cancel_work_sync() to the unregister path, ensuring all pending work items complete or are canceled before memory deallocation occurs.

Business impact

This vulnerability primarily affects enterprise environments with deployed MT7915-based WiFi infrastructure, particularly in server or network appliance deployments. While the vulnerability requires local code execution context to trigger, successful exploitation could lead to kernel crashes (denial of service) or, in less common scenarios, potential privilege escalation or information disclosure depending on memory layout and attacker capabilities. Organizations relying on MT7915 hardware for critical connectivity may experience unexpected system restarts or instability during device hotplug or module unload operations.

Affected systems

Linux systems running kernel versions with the vulnerable mt76 driver code for MT7915 chipsets are affected. This includes embedded devices, access points, and systems with integrated or discrete MT7915 WiFi adapters. The vulnerability exists across distributions until they apply the specific kernel patch addressing the race condition. Systems that do not use MT7915 hardware or do not load the mt76 driver are unaffected.

Exploitability

The vulnerability requires local access to the affected system and involves triggering a specific race condition between device removal and work queue execution. An unprivileged local user with the ability to trigger WiFi driver hotplug events or force module unload operations could potentially trigger the condition. However, exploiting it reliably for purposes beyond denial of service would require precise timing and knowledge of memory layout, making it moderately difficult but not infeasible for a local attacker with system access.

Remediation

Apply the Linux kernel patch that adds cancel_work_sync() in mt7915_unregister_device() to synchronize the dump_work before crash_data deallocation. Verify the fix has been incorporated in your kernel version by checking commit history or release notes. For systems unable to update immediately, limit local user access to minimize the attack surface, and monitor for unexpected kernel crashes related to mt7915 driver operations.

Patch guidance

Verify your Linux kernel version against the upstream kernel patch for CVE-2026-53098, which resolves the race condition by adding proper work cancellation before memory deallocation. Check your distribution's kernel update advisories for the specific patched version available for your release. Patching requires a kernel update and typically necessitates a system reboot. Test kernel updates in a non-production environment first, particularly if your deployment relies on WiFi connectivity.

Detection guidance

Monitor system logs for kernel warnings or panics mentioning mt7915 driver or use-after-free conditions. Enable KASAN (Kernel Address Sanitizer) in test environments to detect UAF issues during development or pre-production validation. Watch for unexpected WiFi driver unload failures or device removal hangs that might indicate the race condition. Check dmesg output for stack traces referencing mt7915_mac_dump_work() or mt7915_coredump_unregister().

Why prioritize this

This vulnerability scores 7.8 (HIGH) due to the combination of high-impact consequences (kernel crash, potential code execution) and the local attack vector requiring presence on the system. While not remotely exploitable, it poses a meaningful risk in shared hosting, embedded device, and multi-tenant scenarios. Organizations should prioritize patching systems where MT7915 hardware is deployed and local user access is possible, particularly in environments where system stability is critical.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: local attack vector (AV:L) limiting scope to local attackers; low complexity (AC:L) as the race condition does not require specialized conditions; low privilege requirement (PR:L) as any local user can potentially trigger device hotplug; high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) due to kernel memory access. The score appropriately captures the severity while acknowledging the local-only nature of the threat.

Frequently asked questions