CVE-2026-53104: Linux Kernel MT76 Memory Leak Vulnerability

CVE-2026-53104 Overview

CVE-2026-53104 is a memory leak vulnerability in the Linux kernel's mt76 WiFi driver. The flaw resides in the device cleanup path, where the driver fails to destroy page_pool instances associated with receive (RX) queues that are not bound to a NAPI context. This includes Wireless Ethernet Dispatch (WED) Receive Reorder (RRO) queues when WED is enabled. Pages allocated to these queues are not returned to the pool when WED is disabled, causing kernel memory to leak each time the module is unloaded or the device is destroyed.

Critical Impact
Repeated module reload or device teardown on systems using MediaTek MT76 wireless hardware can exhaust kernel memory, leading to system instability and denial of service.

Affected Products

Linux kernel mt76 WiFi driver (MediaTek MT76 chipset family)
Kernel branches addressed by commits 4b7c92f, 6b470f3, and dcbc13d
Systems using MediaTek wireless hardware with WED RRO queue configurations

Discovery Timeline

2026-06-24 - CVE-2026-53104 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53104

Vulnerability Analysis

The mt76 driver allocates a page_pool for every RX queue, including queues that operate outside of a NAPI polling context. WED RRO queues fall into this category when WED hardware acceleration is enabled. The original cleanup routine, mt76_dma_cleanup, only released page_pool resources for NAPI-associated queues, leaving the remaining pools dangling at module unload.

This is a memory leak [CWE-401] in the device destruction path. The leaked memory is not user-controllable data but kernel page allocations backing DMA buffers. Each unload-reload cycle of the driver compounds the leak. On embedded routers and access points using MediaTek silicon, frequent driver restarts during configuration changes or firmware updates can degrade available kernel memory over time.

Root Cause

The root cause is incomplete resource management in mt76_dma_cleanup. The function did not iterate over all RX queues with attached page_pool instances, omitting those without NAPI bindings. Additionally, the WED RRO code path did not return outstanding pages to the pool when WED was not enabled, preventing the pool from being freed cleanly.

Attack Vector

The issue is not remotely exploitable for code execution. The practical impact is resource exhaustion. A local user with privileges to load and unload kernel modules, or any workflow that repeatedly tears down and re-initializes the mt76 device, will progressively consume kernel memory. On long-running systems, this can result in out-of-memory conditions or kernel allocator pressure that degrades wireless performance and system stability.

No exploitation code is required to trigger the condition; the leak occurs as part of normal driver lifecycle operations. The vulnerability has no known public exploit and is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.166%.

Detection Methods for CVE-2026-53104

Indicators of Compromise

Steadily increasing kernel slab and page allocator usage on systems running the mt76 driver, visible via /proc/meminfo and /proc/slabinfo.
Growing nr_free_pages deficit after repeated modprobe -r mt76 and modprobe mt76 cycles.
Kernel log entries referencing page_pool resources during device teardown on MediaTek wireless hardware.

Detection Strategies

Audit kernel and module versions across MediaTek-based wireless infrastructure to identify hosts running pre-patch mt76 builds.
Monitor page_pool statistics exposed through ethtool or kernel tracepoints for queues that show non-zero inflight pages after device teardown.
Correlate wireless driver restart events with memory pressure metrics to flag systems exhibiting the leak pattern.

Monitoring Recommendations

Track kernel memory consumption trends over 24-72 hour windows on access points and embedded devices using mt76.
Enable CONFIG_PAGE_POOL_STATS where supported to expose pool allocation counters for telemetry pipelines.
Alert on unexpected mt76 module reloads, particularly in production WiFi infrastructure where reloads should be rare.

How to Mitigate CVE-2026-53104

Immediate Actions Required

Apply the upstream kernel commits 4b7c92f, 6b470f3, and dcbc13d or upgrade to a kernel release that includes them.
Inventory all systems running the mt76 driver and prioritize patching on devices with high uptime or frequent driver reload activity.
Reboot affected systems after patching to release accumulated leaked memory.

Patch Information

The fix updates mt76_dma_cleanup to destroy page_pool instances for all RX queues, including those not associated with a NAPI context such as WED RRO queues. The patch also returns outstanding pages to the pool when WED is not enabled, allowing the pool to be released cleanly. Patches are available in the mainline Linux kernel via Kernel Git Commit 4b7c92f, Kernel Git Commit 6b470f3, and Kernel Git Commit dcbc13d.

Workarounds

Avoid repeated unload and reload of the mt76 module on production systems until the patch is applied.
Schedule periodic reboots on affected devices to reclaim leaked kernel memory where immediate patching is not feasible.
Where WED is not required, evaluate whether disabling WED RRO queue configurations reduces leak accumulation on the specific deployment.

bash

# Verify mt76 driver and kernel version on affected hosts
uname -r
modinfo mt76 | grep -E '^(version|srcversion|filename)'

# Monitor kernel memory trend after driver activity
watch -n 5 "grep -E 'MemFree|Slab|PageTables' /proc/meminfo"