CVE-2026-53100 Overview
CVE-2026-53100 is a kernel deadlock vulnerability in the Linux mt76 Wi-Fi driver, which supports MediaTek wireless chipsets. The flaw resides in the remain-on-channel handling code, where mt76_remain_on_channel() and mt76_roc_complete() invoke mt76_set_channel() while already holding dev->mutex. Because mt76_set_channel() re-acquires the same mutex, the call path deadlocks. A secondary deadlock involves the mac_work delayed workqueue. The issue has been patched upstream across multiple stable kernel branches.
Critical Impact
Local attackers or unprivileged users triggering remain-on-channel operations can hang the wireless subsystem, causing a denial of service on affected Linux systems using MediaTek Wi-Fi hardware.
Affected Products
- Linux kernel mt76 Wi-Fi driver (MediaTek wireless chipsets)
- Linux distributions shipping vulnerable stable kernel branches prior to the fix commits
- Embedded and consumer devices using MediaTek Wi-Fi with mainline-derived kernels
Discovery Timeline
- 2026-06-24 - CVE-2026-53100 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53100
Vulnerability Analysis
The mt76 driver implements remain-on-channel (ROC) functionality, which instructs a Wi-Fi device to stay on a specific channel for offchannel operations such as P2P negotiations. Both mt76_remain_on_channel() and mt76_roc_complete() acquire dev->mutex before calling into channel-switching helpers. Inside that critical section they invoke mt76_set_channel(), which itself attempts to lock dev->mutex. Because the mutex is non-recursive, the second acquisition blocks indefinitely. This is a classic self-deadlock condition [CWE-833].
A secondary deadlock exists with the mac_work delayed workqueue. The work item also contends for dev->mutex, so an in-flight mac_work execution can block ROC entry, while ROC holding the mutex blocks the work item from completing.
Root Cause
The root cause is improper lock management in the ROC code paths. Callers acquired dev->mutex and then invoked an API variant that also acquires the same lock, rather than the unlocked internal helper __mt76_set_channel(). No precaution was taken to drain the mac_work delayed work before entering the locked region.
Attack Vector
Exploitation requires the ability to trigger remain-on-channel operations on the affected wireless interface, typically through standard nl80211/cfg80211 interfaces used by wpa_supplicant, P2P stacks, or Wi-Fi management tooling. A local user with access to wireless configuration, or a malicious userspace component, can induce the deadlock and stall the wireless stack, producing a denial of service against the host.
The vulnerability is a synchronization defect; no code execution, memory corruption, or information disclosure has been described. See the upstream fix commits referenced below for the precise call paths.
Detection Methods for CVE-2026-53100
Indicators of Compromise
- Kernel hung task warnings naming mt76_remain_on_channel, mt76_roc_complete, or mt76_set_channel in dmesg or /var/log/kern.log.
- Wireless interface becoming unresponsive after P2P or offchannel operations, with nl80211 commands timing out.
- mac_work worker threads stuck in D (uninterruptible sleep) state visible in ps or /proc/<pid>/stack.
Detection Strategies
- Monitor kernel ring buffer for task ... blocked for more than N seconds messages tied to mt76 symbols.
- Audit installed kernel package versions against the fixed commits 5fc8c5d4, 6939b97d, and 7a89c245 from the upstream stable tree.
- Track wireless subsystem health metrics such as ROC completion latency and number of stalled cfg80211 operations.
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on mt76 deadlock signatures.
- Inventory endpoints and embedded devices using MediaTek Wi-Fi chipsets to scope exposure.
- Track upstream linux-stable advisories for additional backports affecting your kernel branch.
How to Mitigate CVE-2026-53100
Immediate Actions Required
- Apply the upstream patches that replace mt76_set_channel() with __mt76_set_channel() in the ROC paths and add cancel_delayed_work_sync() for mac_work before acquiring dev->mutex.
- Update to the distribution kernel release that incorporates the fix for your stable branch.
- For systems unable to patch immediately, restrict use of P2P and remain-on-channel features that exercise the vulnerable code path.
Patch Information
The fix is committed upstream in the Linux stable tree. Refer to Kernel Git Commit 5fc8c5d, Kernel Git Commit 6939b97d, and Kernel Git Commit 7a89c245. The patches switch ROC paths to the unlocked __mt76_set_channel() helper and synchronously cancel mac_work before taking dev->mutex.
Workarounds
- Disable P2P and offchannel features in wpa_supplicant configuration where business requirements allow.
- Unload the mt76 driver on systems that do not require MediaTek Wi-Fi functionality.
- Constrain local user access to wireless management interfaces via Polkit or group membership restrictions.
# Verify running kernel and mt76 module status
uname -r
modinfo mt76 | grep -E '^(version|filename):'
# Optional: blacklist the mt76 driver where Wi-Fi is not needed
echo 'blacklist mt76' | sudo tee /etc/modprobe.d/blacklist-mt76.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
