CVE-2026-53098: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53098 Overview

CVE-2026-53098 is a use-after-free (UAF) vulnerability in the Linux kernel's mt76 wireless driver, specifically affecting the MediaTek mt7915 Wi-Fi PCI chipset support. The flaw resides in the mt7915_mac_dump_work() function and is triggered by a race condition between device removal and pending crash dump work items. When the PCI device detaches, mt7915_coredump_unregister() frees the crash_data structure while the dump_work workqueue item may still reference it, resulting in dereference of freed memory.

The issue has been resolved in the upstream Linux kernel by adding cancel_work_sync() in mt7915_unregister_device() to synchronize cleanup with any pending or executing dump work.

Critical Impact
Local triggering of the race condition during mt7915 PCI device detach can lead to kernel memory corruption, potential denial of service, or privilege escalation on systems using MediaTek mt7915 Wi-Fi hardware.

Affected Products

Linux kernel versions containing the mt76 driver with mt7915 PCI support prior to the fixing commits
Systems using MediaTek mt7915 Wi-Fi PCI chipsets
Distributions shipping vulnerable stable kernel branches referenced in the patch set

Discovery Timeline

2026-06-24 - CVE-2026-53098 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53098

Vulnerability Analysis

The vulnerability is a classic use-after-free condition caused by improper lifecycle management of a kernel work item. The mt7915 driver maintains a crash_data structure used to capture firmware and MAC dumps when recovery is triggered. During PCI device removal, mt7915_pci_remove() calls mt7915_unregister_device(), which in turn calls mt7915_coredump_unregister() to free dev->coredump.crash_data via vfree().

Concurrently, a worker thread can be running or scheduled to run mt7915_mac_dump_work(), queued by mt7915_reset() through the mt7915_sys_recovery_set() path. Without synchronization between the removal path and the workqueue, the worker may dereference crash_data after it has been freed, corrupting kernel memory or triggering an oops.

Root Cause

The root cause is missing synchronization between the unregister path and the asynchronous dump work item. The driver did not invoke cancel_work_sync() on dump_work before releasing crash_data, allowing the worker to outlive the data it operates on. This is a lifetime management defect rather than a memory safety issue in vfree() itself.

Attack Vector

Triggering the race requires the ability to initiate device reset or recovery operations while the mt7915 PCI device is being detached. An attacker with local access capable of inducing driver reset or hot-unplug events on a system with vulnerable mt7915 hardware could attempt to win the race. Successful exploitation results in dereferencing freed kernel memory, which can yield denial of service or, with additional primitives, kernel memory corruption.

The race condition window is described in the commit message as follows:

CPU 0 (removal path)               | CPU 1 (workqueue)
mt7915_pci_remove()                | mt7915_sys_recovery_set()
 mt7915_unregister_device()        |  mt7915_reset()
  mt7915_coredump_unregister()     |   queue_work()
   vfree(dev->coredump.crash_data) | mt7915_mac_dump_work()
                                   |  crash_data-> // UAF

Source: Kernel Git Commit 1146d09

Detection Methods for CVE-2026-53098

Indicators of Compromise

Kernel oops or panic messages referencing mt7915_mac_dump_work in stack traces, particularly during or after PCI device removal
KASAN (Kernel Address Sanitizer) reports identifying use-after-free in the mt76/mt7915 driver path
Unexpected system instability or crashes when mt7915 Wi-Fi adapters are reset, recovered, or hot-unplugged

Detection Strategies

Audit running kernel versions against the fixing commits referenced in the Kernel Git Commit 1146d09 and related stable backports
Enable KASAN on test or canary systems to surface UAF behavior in the mt76 driver under reset and detach workloads
Collect kernel logs via journalctl -k and search for mt7915 and crash_data references during device lifecycle events

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM pipeline and alert on mt7915 oops or warning entries
Monitor for unexpected Wi-Fi driver resets or PCI hotplug events on fleet endpoints using affected hardware
Track kernel package versions across the fleet and flag hosts running kernels prior to the patch commits

How to Mitigate CVE-2026-53098

Immediate Actions Required

Update affected Linux systems to a kernel version that includes the fix from one of the referenced stable commits
Inventory endpoints, servers, and embedded systems using MediaTek mt7915 Wi-Fi hardware and prioritize them for patching
Restrict local user ability to trigger driver resets and PCI hotplug operations where feasible until patches are deployed

Patch Information

The fix adds cancel_work_sync() in mt7915_unregister_device() to ensure dump_work cannot execute after crash_data is freed. Patches are available in upstream and stable branches via the following commits: Kernel Git Commit 1146d09, Kernel Git Commit 21ce6d86, Kernel Git Commit 6b7cbb13, Kernel Git Commit 6d520240, and Kernel Git Commit e6856af8. Apply the kernel update appropriate for your distribution and reboot affected hosts.

Workarounds

If patching is not immediately possible, blacklist the mt7915e and related mt76 modules on systems that do not require Wi-Fi connectivity
Avoid manual driver reset operations and limit unprivileged users' ability to trigger PCI rescan or hot-unplug actions
Use a USB or alternative Wi-Fi adapter not driven by mt7915 until kernel updates are applied

bash

# Blacklist the vulnerable driver module until a patched kernel is deployed
echo 'blacklist mt7915e' | sudo tee /etc/modprobe.d/blacklist-mt7915.conf
echo 'blacklist mt7915_common' | sudo tee -a /etc/modprobe.d/blacklist-mt7915.conf
sudo update-initramfs -u
sudo reboot

# Verify the running kernel version after applying the vendor patch
uname -r