CVE-2026-53097: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53097 Overview

CVE-2026-53097 is a use-after-free vulnerability in the Linux kernel mt76 wireless driver for MediaTek mt7996 PCI Wi-Fi chipsets. The flaw exists in mt7996_mac_dump_work(), which can dereference mt7996_crash_data after it has been freed by mt7996_coredump_unregister() during device removal. A race condition between the PCI removal path and the workqueue-scheduled dump work allows the freed crash_data structure to be accessed concurrently. Maintainers resolved the issue by adding cancel_work_sync() in mt7996_unregister_device() to synchronize pending dump work before deallocation.

Critical Impact
Concurrent execution of mt7996_mac_dump_work() against a freed crash_data buffer can lead to kernel memory corruption, instability, or local denial of service on systems using MediaTek mt7996 Wi-Fi hardware.

Affected Products

Linux kernel builds shipping the mt76 driver with mt7996 support
Systems with MediaTek mt7996 PCI Wi-Fi chipsets
Distributions tracking mainline kernel prior to the referenced stable patches

Discovery Timeline

2026-06-24 - CVE-2026-53097 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53097

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] race condition in the MediaTek mt7996 Wi-Fi driver path. During device detach, mt7996_pci_remove() calls mt7996_unregister_device(), which invokes mt7996_coredump_unregister(). That function executes vfree(dev->coredump.crash_data), releasing the crash data buffer.

Concurrently, on a separate CPU, mt7996_sys_recovery_set() may have queued mt7996_mac_dump_work() through mt7996_reset() and queue_work(). If the work item runs or remains pending after crash_data is freed, the dump worker dereferences the stale pointer. This produces classic use-after-free behavior in kernel context.

The race occurs because the removal path does not synchronize with the workqueue before releasing the buffer. Without an explicit cancellation barrier, the worker and the deallocator operate on the same object without ordering guarantees.

Root Cause

The root cause is missing synchronization between the device teardown path and the asynchronous dump_work workqueue item. The driver freed crash_data without first ensuring that no dump_work instance was running or queued, leaving a window in which the worker could touch released memory.

Attack Vector

Triggering the race requires local conditions that initiate device removal while a crash-dump or recovery workflow is in flight on the mt7996 driver. This is not a network-reachable issue and requires local interaction with the Wi-Fi subsystem, such as unbinding the PCI device while recovery work is scheduled. Successful exploitation produces kernel memory corruption that can cause a system crash or, in unfavorable allocator states, may be leveraged for further memory safety attacks.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS data reflects a low probability of exploitation activity at this time.

The vulnerability is described in prose only because no verified exploit code is available. Refer to the upstream commits for the precise diff and call paths.

Detection Methods for CVE-2026-53097

Indicators of Compromise

Kernel oops or panic traces referencing mt7996_mac_dump_work, mt7996_coredump_unregister, or vfree on crash_data
KASAN reports flagging use-after-free in the mt76/mt7996 driver during device removal or reset
Repeated Wi-Fi adapter resets or mt7996_sys_recovery_set activity correlated with PCI detach events

Detection Strategies

Enable KASAN in test and staging kernels to surface UAF accesses in mt76 code paths
Audit dmesg for stack traces involving mt7996_mac_dump_work alongside detach or rmmod events
Track unexpected kernel crashes on hosts using MediaTek mt7996 hardware and correlate with module unload timing

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on mt7996 worker stack traces
Monitor host availability metrics for Wi-Fi-equipped Linux endpoints and laptops using mt7996 chipsets
Inventory running kernel versions across the fleet to identify hosts that have not yet absorbed the upstream fix

How to Mitigate CVE-2026-53097

Immediate Actions Required

Apply the upstream stable patches for the mt76 driver that introduce cancel_work_sync() in mt7996_unregister_device()
Update to a distribution kernel build that incorporates the referenced commits
Restrict local users who can unbind PCI devices or trigger Wi-Fi recovery on affected systems

Patch Information

The fix ensures dump_work is canceled before crash_data is deallocated by calling cancel_work_sync() in mt7996_unregister_device(). Stable kernel patches are available at the following commits: 180182a3f23f, 188e10f9ea31, aa4a31cd89f4, and c8f62f73bbce.

Workarounds

Avoid unbinding or hot-removing the mt7996 PCI device on production systems until patches are applied
Where Wi-Fi is not required, blacklist the mt7996 and mt76 modules to remove the vulnerable code path
Disable userspace tooling that can trigger mt7996_sys_recovery_set flows during normal operation

bash

# Configuration example: blacklist the mt7996 driver until patched kernel is installed
echo "blacklist mt7996e"   | sudo tee /etc/modprobe.d/mt7996-cve-2026-53097.conf
echo "blacklist mt7996_common" | sudo tee -a /etc/modprobe.d/mt7996-cve-2026-53097.conf
sudo update-initramfs -u