CVE-2026-53102: Linux mt76 WiFi Driver Memory Leak Vulnerability

Technical summary

CVE-2026-53102 is a memory leak in the mt76 WiFi driver's station management code. The function mt76_connac_mcu_alloc_sta_req() allocates a socket buffer (skb) that should normally be freed by mt76_mcu_skb_send_msg(). However, when mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() fail after allocation but before transmission, the skb is not freed, creating a memory leak. The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The fix involves explicit skb deallocation in the error paths, similar to a prior fix applied in commit 7c0f63fe37a5.

Business impact

Memory leaks in kernel-level WiFi drivers can accumulate over extended operation, particularly in systems with frequent WiFi station state changes (e.g., roaming, reconnection events). On embedded systems, edge devices, or servers with limited memory, this could eventually degrade performance or trigger system instability. For organizations managing fleets of devices with MediaTek WiFi hardware, persistent kernel memory leaks increase support costs and device reboot requirements. The severity is moderated because successful exploitation requires local system access and sustained triggering of error conditions.

Affected systems

This vulnerability affects Linux systems equipped with MediaTek mt76 WiFi chipsets. Vulnerable systems include devices running the affected Linux kernel code that uses the mt76 driver—primarily embedded systems, laptops, and edge devices with MediaTek wireless hardware. The vulnerability requires local access to trigger and does not propagate remotely. Verify your kernel version and mt76 driver version against the vendor patch advisory to determine if your systems are affected.

Exploitability

Exploitation requires local system access and the ability to trigger station management operations that cause intermediate function failures. This is not a remote vulnerability and does not lead to privilege escalation or code execution. An attacker with local access could potentially accelerate memory exhaustion by repeatedly forcing error conditions during WiFi station operations, but this is a slow, low-impact exploitation path. The vulnerability is unlikely to be weaponized in real-world attacks due to the limited practical value compared to more direct attack vectors.

Remediation

Update the Linux kernel to a version that includes the memory leak fix in the mt76 driver. Verify the specific patched kernel version through your Linux distribution's security advisories and the upstream Linux kernel repository. For vendors packaging the mt76 driver separately, updates may also be available as driver-specific patches. Systems should prioritize kernel updates that address this and concurrent security issues rather than patching this issue in isolation.

Patch guidance

Consult your Linux distribution's official security advisories and kernel release notes for the patched kernel version addressing this vulnerability. Upstream patches should be available in the Linux kernel repository under the wifi/mt76 subsystem. Organizations should apply patches as part of scheduled kernel maintenance windows, testing in non-production environments first. Compile testing is available; full testing should verify that WiFi station operations and roaming function correctly post-patch.

Detection guidance

Monitor kernel memory usage patterns on systems with mt76 WiFi adapters, particularly memory in the 'slab' or 'kmalloc' categories that does not recover after WiFi state changes. Kernel debuggers (kmemleak) can be enabled to identify unreleased memory allocations. Check system logs for repeated allocation failures or WiFi driver warnings that could indicate the error path is being triggered. Note that this issue does not produce straightforward attack signatures—detection requires memory profiling or code inspection rather than traffic analysis.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 5.5 (Medium) reflects the local-only attack requirement and lack of confidentiality or integrity impact. However, organizations with large fleets of edge devices or embedded systems using MediaTek WiFi should prioritize patching sooner to prevent cumulative memory degradation. Systems in environments requiring high uptime and minimal reboots should be prioritized for testing and patching.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), but high availability impact (A:H) due to potential memory exhaustion. The score appropriately discounts the vulnerability for its requirement of local access and the impractical nature of sustained exploitation.

Frequently asked questions