CVE-2026-53107: Linux Kernel Libertas WiFi Vulnerability

CVE-2026-53107 Overview

CVE-2026-53107 is a Linux kernel vulnerability in the libertas Wi-Fi driver. The driver enforced transmission path serialization by calling usb_kill_urb() and usb_kill_anchored_urbs() to wait for prior USB Request Blocks (URBs) to complete. These calls can sleep, but usb_tx_block() may run from interrupt context, such as the USB Host Controller Driver (HCD) giveback path. Invoking a sleeping function from interrupt context can trigger kernel warnings, scheduling faults, or system instability. The fix replaces the kill operation with a check of the tx_submitted anchor and returns -EBUSY when a request is already in flight.

Critical Impact
Local conditions in the libertas USB Wi-Fi TX path can cause sleep-in-atomic-context faults, leading to kernel warnings or denial of service on affected systems.

Affected Products

Linux kernel — drivers/net/wireless/marvell/libertas USB Wi-Fi driver
Systems using Marvell libertas USB Wi-Fi adapters
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-06-24 - CVE-2026-53107 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53107

Vulnerability Analysis

The libertas driver serializes Wi-Fi transmissions over USB by ensuring only one URB is outstanding at a time. The original implementation called usb_kill_urb() or usb_kill_anchored_urbs() inside usb_tx_block() to wait for in-flight URBs to drain. Both functions can sleep while waiting for the URB completion handler to finish. The usb_tx_block() function is reachable from atomic contexts, including the HCD URB completion (giveback) path. Sleeping in interrupt context violates kernel locking rules and can result in BUG: scheduling while atomic warnings, kernel taint, or deadlock under load.

Root Cause

The root cause is improper synchronization primitive selection in an atomic execution context [CWE-1322 style sleep-in-atomic]. The driver assumed usb_tx_block() always ran in process context where blocking waits were safe. In practice, the function is invoked from the HCD giveback path, which executes with interrupts disabled or in softirq context. Calling sleep-capable APIs there is unsafe.

Attack Vector

The issue is reachable through normal Wi-Fi transmission activity on hosts using libertas USB adapters. Sustained or unusual TX patterns that race with URB completion can trigger the unsafe code path. The fault is a local reliability and availability issue rather than a remote code execution primitive. No authentication bypass or privilege escalation has been documented for this defect.

No verified exploit code exists. The upstream fix is documented in the kernel commits referenced under Kernel Git Commit 7c5c2b6, Kernel Git Commit 4f273d3, and Kernel Git Commit 00c0317.

Detection Methods for CVE-2026-53107

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic or sleeping function called from invalid context referencing usb_kill_urb or usb_kill_anchored_urbs.
Stack traces in dmesg showing usb_tx_block invoked from a USB HCD giveback path.
Unexpected Wi-Fi interface stalls, resets, or driver taint flags on hosts using Marvell libertas USB adapters.

Detection Strategies

Inventory running kernel versions and compare against the patched stable releases listed in the referenced kernel git commits.
Audit hosts for the presence of the libertas and libertas_usb modules using lsmod and modinfo.
Enable kernel lockdep and CONFIG_DEBUG_ATOMIC_SLEEP in test environments to surface sleep-in-atomic conditions originating in this driver.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log platform and alert on atomic-context warnings.
Track Wi-Fi interface flap counts and driver reset events on endpoints that use libertas adapters.
Correlate kernel taint state with asset inventory to identify systems still running unpatched builds.

How to Mitigate CVE-2026-53107

Immediate Actions Required

Update the Linux kernel to a stable release that includes the fixes referenced by commits 7c5c2b6, 4f273d3, and 00c0317.
Identify endpoints using Marvell libertas USB Wi-Fi hardware and prioritize them for kernel updates.
Reboot patched systems to load the corrected libertas module and confirm the prior warning signatures no longer appear.

Patch Information

The upstream fix removes the call to usb_kill_urb() and usb_kill_anchored_urbs() from usb_tx_block(). The patched code checks the tx_submitted anchor and returns -EBUSY when an URB is already pending. This preserves TX serialization without invoking sleep-capable APIs from interrupt context. Backports are available in the kernel.org stable tree under the commits 00c0317, 4f273d3, and 7c5c2b6.

Workarounds

Unload the libertas_usb and libertas modules on systems that do not require the affected Wi-Fi hardware: sudo modprobe -r libertas_usb libertas.
Blacklist the modules until patched kernels are deployed by adding blacklist libertas and blacklist libertas_usb to /etc/modprobe.d/.
Replace affected Marvell libertas USB adapters with hardware supported by maintained drivers where operational requirements allow.

bash

# Configuration example
# Verify running kernel and libertas module status
uname -r
lsmod | grep libertas

# Temporarily unload the affected driver
sudo modprobe -r libertas_usb libertas

# Persistently blacklist the driver until the patched kernel is installed
echo -e "blacklist libertas\nblacklist libertas_usb" | \
  sudo tee /etc/modprobe.d/cve-2026-53107.conf
sudo update-initramfs -u