CVE-2026-53102 Overview
CVE-2026-53102 is a memory leak vulnerability in the Linux kernel's mt76 MediaTek WiFi driver. The flaw exists in error paths following calls to mt76_connac_mcu_alloc_sta_req(), which allocates a socket buffer (skb) expected to be freed by mt76_mcu_skb_send_msg(). When intermediate functions such as mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() fail before the send call, the allocated skb is leaked. The issue was identified through a prototype static analysis tool and code review, and has been resolved upstream.
Critical Impact
Repeated triggering of the failing code paths can exhaust kernel memory on systems using MediaTek WiFi hardware, leading to degraded performance or denial of service.
Affected Products
- Linux kernel mt76 WiFi driver subsystem
- Systems using MediaTek mt76_connac chipsets
- Linux distributions shipping the affected kernel versions prior to the upstream fix
Discovery Timeline
- 2026-06-24 - CVE-2026-53102 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53102
Vulnerability Analysis
The vulnerability resides in the MediaTek mt76 WiFi driver, which manages station (STA) management commands through the microcontroller unit (MCU) interface. The function mt76_connac_mcu_alloc_sta_req() allocates a socket buffer (skb) used to construct an MCU station request message. Under normal flow, this skb is consumed and freed by mt76_mcu_skb_send_msg() after the request is fully built and dispatched to the firmware.
The leak occurs because two intermediate helpers, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv(), can return errors before the send call is reached. In these error paths, the previously allocated skb is not released, leaving the buffer permanently allocated in kernel memory. Each failed STA request consumes additional non-reclaimable memory.
A similar pattern was previously addressed in commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error"), confirming the recurrent nature of this skb lifecycle bug across the driver.
Root Cause
The root cause is incorrect resource ownership handling in error paths. The skb is allocated by one function but is expected to be freed by a later send function. When an intermediate function fails between allocation and send, no cleanup logic releases the skb, resulting in a classic memory leak [CWE-401].
Attack Vector
An attacker or local condition that reliably triggers failures in mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() can cause repeated skb leaks. Over time this depletes kernel memory on affected MediaTek WiFi systems. The vulnerability requires local interaction with the driver subsystem and is not directly remotely exploitable based on available information.
No public proof-of-concept exploit code is available. The issue was confirmed via static analysis and code review, and was compile-tested only. See the Kernel Git Commit Log for the upstream fix details.
Detection Methods for CVE-2026-53102
Indicators of Compromise
- Gradual, unexplained growth in kernel slab memory allocations on systems using MediaTek mt76_connac WiFi hardware
- Recurring failures from mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() in kernel logs
- WiFi connectivity issues correlated with memory pressure events
Detection Strategies
- Inspect /proc/slabinfo for unbounded growth of skbuff_head_cache entries on long-running systems with MediaTek WiFi adapters
- Audit kernel versions against the upstream stable commits c41075ce8cf05ed8c0e7b7efef000dce548ffc42 and eb466406d2094deefadc2cd6ddb4f6eeb086d1b4 to verify patch status
- Enable kernel memory leak detection (kmemleak) on test systems to confirm the leak pattern in the mt76 driver
Monitoring Recommendations
- Monitor kernel free memory and slab cache size trends over time on hosts and APs using MediaTek WiFi chipsets
- Collect dmesg output for repeated mt76 MCU command failures that may indicate triggering of the leak paths
- Track distribution kernel package updates to confirm timely application of fixes
How to Mitigate CVE-2026-53102
Immediate Actions Required
- Identify all Linux systems running the mt76 driver with MediaTek mt76_connac chipsets
- Update affected systems to a Linux kernel version containing both upstream fix commits
- Reboot systems after kernel updates to ensure the patched driver is loaded
Patch Information
The vulnerability has been resolved upstream in the Linux kernel. The fix explicitly frees the allocated skb in the error paths of mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv(). Refer to the upstream commits at the Kernel Git Commit Log (c41075c) and the Kernel Git Commit Log (eb46640). Apply vendor-provided kernel updates from your Linux distribution as they become available.
Workarounds
- If patching is not immediately possible, schedule periodic reboots on affected systems to reclaim leaked kernel memory
- Unload the mt76_connac module on systems where WiFi is not required, using modprobe -r after disabling wireless services
- Restrict local access to systems with affected WiFi hardware to limit conditions that could trigger the failing code paths
# Verify kernel version and mt76 module status
uname -r
lsmod | grep mt76
# Check for the upstream fix commits in the running kernel source (if available)
git -C /usr/src/linux log --oneline | grep -E 'c41075ce8cf0|eb466406d209'
# Optional: enable kmemleak for diagnostic confirmation (debug kernels only)
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
