CVE-2026-53101: Linux MT7921 Wi-Fi Driver Deadlock Vulnerability

Technical summary

CVE-2026-53101 is a deadlock vulnerability in the MT7921 Wi-Fi driver (drivers/net/wireless/mediatek/mt76/mt7921) within the Linux kernel. The vulnerability arises from improper synchronization in the mt7921_roc_abort_sync() function. When this function calls cancel_work_sync() on the roc_work() queue, it can deadlock if the caller already holds dev->mt76.mutex. The call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() triggers this scenario during station teardown. The roc_work() function holds the same mutex, causing cancel_work_sync() to wait indefinitely for the work to complete while the work queue waits to acquire the held mutex. This is classified as a synchronization/locking failure (CWE-667). The vulnerability has been resolved by refactoring the abort logic to avoid the mutex deadlock while maintaining exactly-once work ownership semantics.

Business impact

This vulnerability can cause system hangs or Wi-Fi interface freezes during routine operations such as disconnecting from a network, removing a station entry, or device hotplug events. On affected systems—particularly laptops and mobile devices relying on MT7921 Wi-Fi chipsets—users may experience unresponsive Wi-Fi interfaces requiring a reboot or driver reload to recover. For enterprise deployments, this can disrupt device management, fleet updates, or seamless roaming scenarios. The impact is localized to availability (denial of service) with no data confidentiality or integrity compromise.

Affected systems

The vulnerability affects Linux kernel systems equipped with Mediatek MT7921 Wi-Fi chipsets. This includes certain laptop models, embedded Linux devices, and development boards that use this Wi-Fi adapter. The vulnerability applies to kernel versions that contain the vulnerable code path; patched versions resolve the issue. Affected users should verify their kernel version and Wi-Fi hardware against the vendor advisory to determine applicability.

Exploitability

Exploitation requires local access to the system (AV:L) and no special privileges beyond a standard user account (PR:L). The condition can be triggered through normal Wi-Fi operations—namely station removal or disconnection—without user interaction (UI:N). While not remotely exploitable, the low barrier to local triggering means any local user can cause the denial-of-service condition. The attack surface is substantial on multi-user or shared systems, and moderate on single-user devices where the user themselves might inadvertently trigger the hang.

Remediation

The fix involves refactoring mt7921_roc_abort_sync() to avoid acquiring or holding dev->mt76.mutex during cancel_work_sync(), breaking the circular lock dependency. The corrected implementation preserves the guarantee that the ROC (Remain-on-Channel) work is executed and cleaned up exactly once. System administrators should apply kernel updates that include the fix to this driver. For systems unable to immediately patch, workarounds such as disabling the MT7921 driver (if alternative Wi-Fi hardware is available) or minimizing frequent station state changes may reduce exposure.

Patch guidance

Apply the latest stable kernel release that includes the fix to drivers/net/wireless/mediatek/mt76/mt7921. Verify the applied patch against the official Linux kernel repository and your distribution's advisory. Test the patch in a non-production environment first, particularly on devices relying on this Wi-Fi adapter as their primary network interface. Check with your device vendor (laptop, router, or embedded device manufacturer) for distribution-specific kernel updates that may incorporate this fix alongside other platform-specific patches.

Detection guidance

Monitor system logs for hung worker threads or mutex timeout warnings related to mt7921 or the mt76 driver. Check for repeated Wi-Fi disconnections, unresponsive Wi-Fi interfaces, or kernel lockdep warnings mentioning the roc_work or mt7921_roc_abort_sync functions. On affected systems, use 'dmesg' or journalctl to search for deadlock-related messages. System administrators can enable kernel lockdep debugging (CONFIG_DEBUG_LOCKDEP=y) in development/test environments to catch the deadlock condition before it impacts production.

Why prioritize this

This vulnerability should be prioritized for patching on systems where the MT7921 Wi-Fi driver is in active use, particularly in environments where Wi-Fi reliability is critical or where frequent station state changes occur. While the CVSS score of 5.5 (Medium) reflects local-only accessibility, the ease of triggering (routine Wi-Fi operations) and the impact on availability (complete Wi-Fi freeze) justify prompt remediation. Organizations with fleet management or automated device enrollment processes should prioritize patching to prevent service disruptions during normal Wi-Fi operations.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity vulnerability. Attack vector (Local) and privileges required (Low) limit remote exploitation but show broad local exposure. The lack of confidentiality or integrity impact (C:N, I:N) is offset by high availability impact (A:H), as the deadlock completely denies Wi-Fi service on affected systems. Scope (Unchanged) indicates the impact is confined to the vulnerable component. The score appropriately reflects a disruptive but contained issue that warrants timely patching without emergency escalation.

Frequently asked questions