CVE-2026-53104: MT76 Linux WiFi Driver Memory Leak During Unload

Technical summary

The MT76 driver allocates page_pool structures for all RX queues regardless of whether they are NAPI-bound. During module unload, the mt76_dma_cleanup routine does not properly destroy these page pools in all cases, leading to CWE-401 (Missing Release of Memory after Effective Lifetime). The vulnerability is particularly acute for WED RRO queues when WED offload is enabled, as the memory management pathway differs from standard NAPI-associated queues. Additionally, when WED is disabled for RRO queues, pages are not returned to the page pool before cleanup, compounding resource leakage.

Business impact

Memory leaks in kernel drivers can accumulate over time, especially in production environments where modules are frequently reloaded (e.g., during driver updates, hardware reconfiguration, or troubleshooting). On systems with constrained memory or running intensive WiFi workloads, repeated instances of this leak may cause gradual performance degradation, increased swap pressure, or eventual out-of-memory conditions. Systems reliant on stable WiFi connectivity—such as IoT gateways, access points, or embedded Linux devices—face reliability risks if memory exhaustion forces unplanned reboots.

Affected systems

Linux systems with MT76-based WiFi hardware and WED (Wireless Ethernet Dispatch) support enabled are most directly affected. This includes certain MediaTek-based WiFi cards and SoCs commonly found in routers, mesh networks, and enterprise access points. The vulnerability manifests during driver lifecycle events: module unload, device removal, or driver restart. Systems running continuously without module reload may experience latent impact only when administrative actions trigger cleanup paths.

Exploitability

This is not a remote exploitable vulnerability. Local privilege escalation is not required—any process capable of unloading or reloading the WiFi driver module can trigger the leak. However, exploitation does not yield immediate code execution or privilege escalation; instead, it is a denial-of-service vector via resource exhaustion. Repeated intentional module reloads by a privileged attacker or through buggy user-space tools could accelerate memory depletion. The CVSS 5.5 MEDIUM score reflects local access requirement and availability impact only.

Remediation

Apply the kernel patch that properly destroys page_pool structures during mt76_dma_cleanup for all RX queue types, and ensures pages are returned to the pool for WED RRO queues when WED is not active. Verify the fix against the Linux kernel repository's MT76 subsystem commits (typically in drivers/net/wireless/mediatek/mt76/). End users should update the kernel and any out-of-tree MT76 driver modules to patched versions.

Patch guidance

Check the Linux kernel's main branch and stable branches for commits addressing MT76 page_pool cleanup. The fix should be present in kernel versions released after the CVE publication date (June 2026). Consult the MediaTek MT76 project page and your Linux distribution's security advisories for backported patches to currently-supported kernel versions. If using out-of-tree MT76 drivers (common in embedded deployments), ensure that source is rebased against a patched upstream version.

Detection guidance

Monitor kernel memory metrics (available/free memory, slab usage) on systems with MT76 hardware, particularly after frequent WiFi driver module reload cycles. Use tools like 'free', 'vmstat', or 'slabtop' to detect gradual memory pressure. Enable kernel memory leak detectors (KMEMLEAK) in test/pre-production environments to catch this and similar leaks before they impact production. Review system logs for repeated module load/unload events that may trigger the leak pathway.

Why prioritize this

Prioritize patching for production WiFi infrastructure (routers, APs, gateways) and IoT deployments where memory is constrained and driver reloads may occur during maintenance windows. The fix is straightforward and low-risk. Systems on continuous uptime without administrative driver reloads face lower urgency, but should still be patched during routine update cycles to avoid latent issues and simplify troubleshooting.

Risk score, explained

CVSS 5.5 MEDIUM reflects: (1) Local attack vector only—no remote exploitation; (2) Low privileges required for exploiting via module reload; (3) High availability impact (resource exhaustion can degrade or crash services); (4) No confidentiality or integrity impact. The score appropriately captures a kernel resource leak as a medium-severity local DoS, not critical, but requiring prompt remediation in production environments.

Frequently asked questions