CVE-2026-53103: Linux MT7925 WiFi Driver Deadlock Vulnerability – Remediation Guide

Technical summary

CVE-2026-53103 addresses a potential deadlock in mt7925_roc_abort_sync() within the Linux kernel's mt76 WiFi driver. The vulnerability occurs when roc_abort_sync() invokes cancel_work_sync() to wait for roc_work() to complete, but roc_work() is concurrently holding dev->mt76.mutex. If the calling context (such as mt76_sta_remove() during station removal) already owns this same mutex, a classic lock-ordering deadlock ensues: the work function cannot release the mutex because cancel_work_sync() blocks the thread that holds it. The issue is classified as a synchronization/lock management flaw (CWE-667) and affects the MediaTek MT7925 wireless adapter support in the Linux kernel.

Business impact

For organizations deploying WiFi-equipped systems with MT7925 adapters, this vulnerability can cause unexpected system hangs or unresponsiveness when wireless stations disconnect or are removed—particularly in environments with frequent station churn such as public WiFi hotspots or mobile deployments. While the deadlock is localized to the WiFi driver and does not persist after reboot, affected systems may require manual intervention to recover, disrupting availability. For enterprise wireless infrastructure or edge computing deployments relying on Linux-based WiFi access points, this could impact service continuity.

Affected systems

The vulnerability affects systems running the Linux kernel with the MT7925 wireless driver compiled and in use. This includes any Linux distribution or embedded system that includes WiFi support for MediaTek MT7925 chipset-based devices. Typical affected hardware includes laptops, tablets, and embedded Linux systems with MT7925 WiFi adapters. Desktop systems and servers without MT7925 chipsets are not affected.

Exploitability

This vulnerability requires local access and the ability to trigger station removal operations on a connected WiFi adapter—for example, by disconnecting a client or removing a peer device entry. An unprivileged local user can trigger the deadlock by manipulating WiFi connections through standard user-space wireless tools. Once triggered, the deadlock freezes the WiFi driver context, though it does not provide privilege escalation or data exfiltration. The attack surface is limited to systems where local users can interact with WiFi connectivity.

Remediation

The fix involves refactoring mt7925_roc_abort_sync() to avoid calling cancel_work_sync() while holding dev->mt76.mutex. The resolved implementation preserves the guarantee of work-function ownership without introducing the lock-ordering deadlock. Users should apply a kernel update that includes the fix once available from their distribution maintainer or verify the patch against the official Linux kernel repositories. Systems running unpatched versions should limit local user access to wireless management tools if feasible.

Patch guidance

Monitor your Linux kernel version and distribution's security updates. When a patched kernel is available, apply it through your standard update mechanism (e.g., apt, yum, or manual compilation). For distributions using long-term support kernels, check the vendor's advisory for backported fixes. Verify that your specific kernel version includes the mt7925_roc_abort_sync() fix by cross-referencing against the upstream Linux kernel commit history or your distribution's changelogs. If you maintain custom kernel builds, apply the upstream patch and recompile.

Detection guidance

Monitor system logs for signs of WiFi driver hangs or unresponsiveness coinciding with station removal events. On affected systems, you may observe kernel messages indicating work queue stalls or mutex contention warnings. Use tools such as `dmesg` or systemd journal to examine driver behavior, and correlate timing with wireless client disconnection events. Stress testing WiFi station addition and removal under load can help identify systems susceptible to the deadlock in test environments before it manifests in production.

Why prioritize this

Although this is a MEDIUM severity vulnerability with a CVSS score of 5.5, it poses a practical denial-of-service risk to WiFi-dependent systems. The deadlock requires only local access and standard WiFi operations to trigger, making it moderately easy to exploit in multi-user or untrusted environments. However, the impact is limited to driver unresponsiveness and does not compromise data confidentiality, integrity, or enable privilege escalation, and the issue can be resolved by rebooting. Prioritize patching in environments with frequent WiFi station churn or where local user access is granted.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, and no special privileges required, balanced against the impact being limited to availability (a hard hang of the WiFi driver). The absence of confidentiality or integrity impact, combined with the need for local access and standard wireless operations, prevents a higher severity rating. The score appropriately captures a moderate, localized disruption rather than a systemic security breach.

Frequently asked questions