CVE-2026-53101: Linux Kernel mt76 Driver DoS Vulnerability

CVE-2026-53101 Overview

CVE-2026-53101 is a deadlock vulnerability in the Linux kernel's mt76 MediaTek WiFi driver, specifically affecting the mt7921 chipset support code. The flaw resides in the mt7921_roc_abort_sync() function, which can deadlock against the concurrently executing roc_work() workqueue handler. Because both code paths contend for dev->mt76.mutex, a caller already holding that mutex while invoking cancel_work_sync() causes the kernel thread to block indefinitely. The condition triggers during station removal flows in the WiFi stack, halting driver progress and stalling network connectivity on affected hardware.

Critical Impact
A reachable deadlock in the mt7921 WiFi driver can hang station teardown operations, causing a denial-of-service condition on systems using MediaTek MT7921 wireless adapters.

Affected Products

Linux kernel versions containing the mt76 driver with mt7921 support prior to the fix
Systems using MediaTek MT7921 series wireless chipsets
Stable Linux kernel branches referenced in the kernel.org commit advisories

Discovery Timeline

2026-06-24 - CVE-2026-53101 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53101

Vulnerability Analysis

The defect is a classic mutex-versus-work-cancellation deadlock [CWE-833]. The roc_work() handler, used for Remain-on-Channel operations in the mt7921 driver, acquires dev->mt76.mutex during execution. Separately, mt7921_roc_abort_sync() calls cancel_work_sync() to ensure pending work has completed before returning. When the abort path is invoked from a context that already owns dev->mt76.mutex, the cancellation primitive waits for roc_work() to finish, while roc_work() itself blocks waiting to acquire the same mutex. Neither thread can make progress.

The upstream Linux kernel patches restructure the cancellation logic to avoid invoking cancel_work_sync() while holding the conflicting mutex, while still preserving exactly-once work ownership semantics. The fix is distributed across multiple stable branches via commits 35180c77, 91e77840, and d5059e52.

Root Cause

The root cause is lock ordering inversion between a synchronously cancelled workqueue item and a shared driver mutex. The call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() enters the abort routine while dev->mt76.mutex is held, violating the invariant required by cancel_work_sync().

Attack Vector

The condition is reached through normal WiFi station removal events, including roaming, interface teardown, disconnection, or driver unload. A local attacker capable of triggering rapid association and disassociation cycles, or repeated interface state changes, could provoke the deadlock and produce a denial-of-service on the affected host. No remote code execution or privilege escalation has been described. See the kernel.org commit reference for the corrected control flow.

Detection Methods for CVE-2026-53101

Indicators of Compromise

Kernel hung task warnings referencing mt7921_roc_abort_sync, cancel_work_sync, or roc_work in dmesg and /var/log/kern.log
Processes blocked in D (uninterruptible sleep) state when interacting with the WiFi interface
Unresponsive WiFi interface on systems using MediaTek MT7921 hardware following association or roaming events

Detection Strategies

Audit installed kernel package versions against vendor advisories that incorporate the upstream fix commits
Inspect lspci and lsmod output to identify hosts loading the mt7921e, mt7921s, or mt7921u modules
Correlate kernel softlockup and hung-task telemetry with WiFi state change events to identify reproducible deadlock conditions

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM pipeline and alert on INFO: task ... blocked for more than messages tied to mt76 symbols
Track kernel build versions across the fleet and flag hosts running pre-patch versions on MediaTek WiFi hardware
Monitor for repeated WiFi link flaps preceding host hangs, which can indicate exploitation of the race window

How to Mitigate CVE-2026-53101

Immediate Actions Required

Update the Linux kernel to a release that includes commits 35180c77, 91e77840, or d5059e52 from the stable trees
Apply distribution vendor updates for the linux-image or equivalent kernel package on systems using MT7921 wireless adapters
Reboot affected hosts after patching to load the corrected mt76 and mt7921 modules

Patch Information

The Linux kernel maintainers resolved the deadlock in the mt76 driver subsystem. Refer to the upstream stable commits for the authoritative fix: kernel.org commit 35180c77, kernel.org commit 91e77840, and kernel.org commit d5059e52. Distribution maintainers backport these changes into supported kernel streams.

Workarounds

Unload the mt7921e, mt7921s, or mt7921u modules on systems where WiFi is not required until the patch is applied
Disable affected MediaTek WiFi interfaces via rfkill block wifi to prevent station state transitions that reach the vulnerable code path
Limit local user ability to trigger rapid WiFi state changes by restricting NetworkManager and wpa_supplicant control interfaces to privileged accounts

bash

# Verify running kernel and module status
uname -r
lsmod | grep mt7921

# Temporarily unload the affected driver until patched
sudo modprobe -r mt7921e mt7921_common mt76_connac_lib mt76

# Block WiFi at the rfkill layer as a stopgap
sudo rfkill block wifi