CVE-2026-53100: Linux mt76 WiFi Deadlock Vulnerability (CVSS 5.5)

Technical summary

CVE-2026-53100 is a deadlock vulnerability in the mt76 WiFi driver subsystem of the Linux kernel. The vulnerability arises in mt76_remain_on_channel() and mt76_roc_complete() functions, which call mt76_set_channel() while already holding the dev->mutex lock. Since mt76_set_channel() internally acquires the same mutex, recursive lock acquisition occurs, causing a deadlock. Additionally, a secondary deadlock risk exists with the mac_work workqueue. The fix involves substituting the internal __mt76_set_channel() function (which does not acquire the mutex) and adding cancel_delayed_work_sync() to drain the mac_work queue before acquiring the mutex.

Business impact

For organizations relying on Linux-based systems with mt76-compatible WiFi hardware for wireless connectivity, this vulnerability can disrupt network availability. Affected services dependent on remain-on-channel operations—such as WiFi scanning, miracast functionality, or peer-to-peer connections—will become unresponsive. In production environments with automated WiFi management or monitoring systems, unexpected hangs could trigger cascading failures. Recovery requires system restart, resulting in service interruption and potential data loss if systems lack graceful shutdown procedures.

Affected systems

Linux systems running vulnerable kernel versions with mt76 WiFi drivers are affected. The mt76 driver is used by MediaTek WiFi chipsets commonly found in embedded devices, access points, routers, and some consumer laptops. Any Linux distribution or embedded Linux system using these chipsets is potentially vulnerable. Systems without mt76 drivers or using alternative WiFi drivers are not affected. Verify your kernel version and WiFi driver status via 'lsmod | grep mt76' and check kernel version with 'uname -r'.

Exploitability

Exploitation requires local access (privilege level: unprivileged user) and no user interaction. An attacker or unprivileged local user can trigger the vulnerability by invoking remain-on-channel operations through WiFi management tools or wpa_supplicant. The attack is trivial to execute once local access is obtained; no special tools or knowledge beyond standard WiFi utilities is required. Network exploitation is not possible; this is a local denial-of-service vector only. The low complexity and lack of privilege escalation requirements make this practical for local attackers.

Remediation

Apply kernel patches that implement the fix: replace mt76_set_channel() calls with __mt76_set_channel() in the affected code paths and add cancel_delayed_work_sync() for mac_work synchronization. Most Linux distributions will deliver these fixes through standard kernel security updates. Check with your distribution's security advisory channels (e.g., Ubuntu Security Notices, Fedora Security Updates, Debian Security Advisories) for patch availability. Kernel rebuild from source is required if your distribution has not yet released a patched kernel version. Until patched, avoid using remain-on-channel WiFi operations where possible.

Patch guidance

Obtain patched kernel versions through your Linux distribution's official update channels. For enterprise deployments, coordinate with your distribution's support team to verify patch availability and release timelines. Verify the patch by confirming that mt76_set_channel() calls have been replaced with __mt76_set_channel() and cancel_delayed_work_sync() has been added in remain-on-channel code paths. Test patched kernels in non-production environments before deployment, particularly if your systems depend on remain-on-channel functionality. Monitor kernel release notes and security advisories from your distribution for specific version numbers; patch availability may vary by distribution and kernel branch.

Detection guidance

Monitor system logs for WiFi driver hangs or remain-on-channel timeouts using 'journalctl -u wpa_supplicant' or similar WiFi service logs. Watch for kernel warnings related to mutex deadlocks in dmesg output. Systems may exhibit symptoms such as unresponsive WiFi interfaces, stuck wpa_supplicant processes, or kernel warnings about 'possible recursive locking detected.' Use 'ps aux | grep -E "kworker|mt76"' to identify if mt76-related kernel threads are stuck. Automated log monitoring can alert on patterns matching 'deadlock', 'remain-on-channel', or mt76-specific error messages. Intrusion detection is not applicable here since this is a local DoS triggered by system operations, not network-based exploitation.

Why prioritize this

Medium severity (CVSS 5.5) warrants prioritization in patching schedules because the availability impact is high and exploitation is trivial for local users. While network compromise is not possible, local DoS can disrupt production WiFi services and trigger broader system failures. Organizations heavily reliant on WiFi availability or those operating multi-tenant systems where unprivileged users have local access should prioritize this fix within 30–60 days. Embedded device manufacturers and router vendors using mt76 drivers should treat this as higher priority due to limited user upgrade capabilities.

Risk score, explained

CVSS 3.1 score of 5.5 (Medium) reflects the high availability impact (A:H) and local attack vector (AV:L) with low complexity (AC:L) and low privilege requirements (PR:L). No confidentiality or integrity impact is possible, limiting the score. The severity is driven primarily by the denial-of-service nature and ease of exploitation for local users. CWE-667 (Improper Locking) correctly categorizes the root cause. The score does not escalate to High because the attack vector is purely local and does not enable system compromise or privilege escalation.

Frequently asked questions