CVE-2026-53317: Linux MT7921 WiFi Driver AID Overflow Firmware Crash

Technical summary

The vulnerability exists in the mt7921 driver's station association handling within the Linux kernel's mt76 subsystem. The firmware cannot properly handle Association IDs (AIDs) exceeding 20, resulting in a crash when such values are configured. The root cause is an insufficient upper bound check during AID allocation at the kernel driver level. The crash manifests exclusively when the interface operates in AP mode (IFTYPE_AP), while STATION mode interfaces are not affected. Standard hostapd implementations naturally avoid this scenario through internal association limits, but custom or modified hostapd builds that change AID allocation behavior can expose the vulnerability.

Business impact

For organizations running MediaTek MT7922-based WiFi infrastructure in access point configurations, this vulnerability presents a denial-of-service risk. A system administrator—whether intentionally or through misconfigured hostapd parameters—could trigger repeated firmware crashes, disrupting wireless service availability. The practical impact is limited by the relative rarity of modified hostapd deployments, but environments using vendor-supplied custom access point software or non-standard configurations face elevated risk. Client devices connecting to affected access points experience temporary service loss during each crash event.

Affected systems

The vulnerability specifically affects systems running the Linux kernel with the mt76 driver using MediaTek MT7921 or MT7922 WiFi hardware when configured in access point (AP) mode. Standard desktop and laptop users connecting to access points via client mode are not vulnerable. The vulnerability is present in Linux kernel versions that include the affected driver code; the fix scope was limited to AP interface configurations, leaving STATION mode operations unchanged.

Exploitability

Exploitability is limited to local actors with administrative or configuration-level access to the access point system. An attacker cannot remotely trigger the crash from a client device; they would need ability to modify hostapd configuration, kernel parameters, or equivalent access point software on the target machine. The barrier to exploitation is moderate—the crash requires explicit configuration of a station AID above 20, which does not occur in standard deployments. Accidental triggering is possible through misconfiguration rather than sophisticated attack techniques.

Remediation

The Linux kernel fix adds an upper bound check on station AID values in the mt7921 driver, rejecting or clamping AID assignments above 20 for AP mode interfaces. Rather than allowing out-of-range AIDs to reach firmware, the driver now prevents the misconfiguration at the kernel level, preventing the crash entirely. The fix does not restore support for high AID numbers; it enforces the firmware's documented limitation. Administrators should verify that their hostapd configuration and any custom access point software respects standard AID allocation ranges (1–20 for this hardware).

Patch guidance

Apply the Linux kernel security patch when available from your distribution's kernel maintenance channel. For production access point systems using MT7922 hardware, prioritize testing the patched kernel in a non-critical environment first to confirm stability and wireless performance. Verify that your hostapd version and any local configuration modifications do not attempt to assign non-standard AID ranges; reverting to stock hostapd parameters provides an immediate workaround. Coordinate patching with your access point deployment schedule to minimize service disruption.

Detection guidance

Monitor system logs and kernel dmesg output for firmware crash signatures associated with mt7921 driver errors or unexpected WiFi interface resets on access point machines. If running custom hostapd, audit hostapd configuration files for any non-standard station ID allocation parameters. Correlate WiFi service outages with access point logs and kernel messages. Wireless intrusion detection tools may not flag this issue as they see it as a local system fault rather than a network-layer attack; focus monitoring on kernel-level events and device restarts.

Why prioritize this

While the CVSS score of 5.5 (MEDIUM) reflects the local-only attack vector and administrative access requirement, this vulnerability should be prioritized in environments deploying custom or modified hostapd builds on MT7922 hardware. For organizations using stock hostapd and standard Linux distributions, risk is lower. Prioritize patching if you run non-standard access point configurations or have modified vendor-supplied hostapd feeds. The patch is low-risk and should be included in routine kernel updates for affected hardware platforms.

Risk score, explained

The CVSS:3.1 score of 5.5 reflects a local attack vector (AV:L), low attack complexity (AC:L), requirement for user-level privileges (PR:L), and no need for user interaction (UI:N). The impact is denial of service—high availability loss (A:H) with no confidentiality or integrity compromise (C:N, I:N). The scope is unchanged (S:U). The score appropriately captures that this is an admin-level configuration issue on the local system rather than a remotely exploitable vulnerability. The MEDIUM severity is justified by the prerequisite knowledge of driver behavior and the limited applicability outside custom deployments.

Frequently asked questions