CVE-2026-53317 Overview
CVE-2026-53317 is a denial-of-service vulnerability in the Linux kernel's mt76 Wi-Fi driver, specifically affecting the mt7921 chipset support. When an access point (AP) interface assigns a station an Association Identifier (AID) greater than 20, the MediaTek firmware crashes. The issue was observed on MT7922 hardware running a modified hostapd sourced from MediaTek's OpenWRT feeds, which allocated AIDs starting at 65. The upstream kernel fix places an upper limit on the AID to prevent the firmware from entering a crash state. The flaw affects IFTYPE_AP interfaces and does not impact IFTYPE_STATION behavior.
Critical Impact
A misconfigured or malicious AP configuration assigning a station AID above 20 triggers a MediaTek Wi-Fi firmware crash, resulting in loss of wireless service on affected devices.
Affected Products
- Linux kernel mt76 driver — mt7921 subsystem
- MediaTek MT7921 / MT7922 Wi-Fi hardware operating as an AP
- Distributions and OpenWRT builds shipping the pre-patch mt76 driver
Discovery Timeline
- 2026-06-26 - CVE-2026-53317 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-53317
Vulnerability Analysis
The mt76 driver provides Linux kernel support for MediaTek Wi-Fi 6 chipsets, including the mt7921 and mt7922. In 802.11 networks, an Association Identifier (AID) is a numeric handle assigned by the AP to each associated station. The mt7921 firmware expects AIDs within a bounded range and does not validate values passed from the host driver. When the driver forwards a station configuration with an AID greater than 20, internal firmware structures are exceeded, and the firmware crashes. A firmware crash removes the wireless interface from service until the device is reset.
Root Cause
The root cause is missing input validation in the mt7921 driver's station configuration path. The driver accepts any AID provided by the network stack, including values produced by non-stock hostapd builds that allocate AIDs outside the expected range. The stock hostapd allocates AIDs starting at 1 and enforces an upper limit through its associated-station cap, which masks the underlying firmware limitation. The kernel patch introduces an explicit upper-bound check so that AIDs exceeding the firmware's supported range are rejected rather than passed through.
Attack Vector
Exploitation requires the ability to influence AP-side station AID assignment on a host running the vulnerable mt76/mt7921 driver. This is typically a local configuration issue, for example running a modified hostapd (such as the MediaTek OpenWRT variant) that allocates AIDs beginning at 65. The vulnerability only manifests on IFTYPE_AP interfaces. Station-mode (IFTYPE_STATION) operation is unaffected. There is no evidence of remote exploitation over the air, and no public proof-of-concept has been released.
The vulnerability manifests when the driver forwards a station AID above 20 to the mt7921 firmware. See the upstream kernel commits referenced below for the exact validation logic added by the fix.
Detection Methods for CVE-2026-53317
Indicators of Compromise
- Kernel log entries indicating an mt7921 firmware crash, reset, or watchdog timeout.
- Sudden loss of the AP interface (wlan0 or equivalent) on devices using MediaTek MT7921/MT7922 hardware.
- hostapd logs showing station association events with AIDs above 20 immediately preceding a firmware fault.
Detection Strategies
- Audit hostapd configuration and source to confirm the AID allocation range used on MediaTek AP deployments.
- Correlate wireless interface resets with association events by cross-referencing dmesg and hostapd logs.
- Monitor for repeated mt76/mt7921 firmware reload messages, which indicate the crash condition is being triggered.
Monitoring Recommendations
- Ingest kernel and hostapd logs from Linux-based APs into a centralized logging or SIEM platform for anomaly review.
- Alert on mt7921 firmware crash strings and on unexpected AP interface downtime.
- Track kernel package versions across fleet devices to identify hosts still running unpatched mt76 code.
How to Mitigate CVE-2026-53317
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org commit 1a4b802afe15, commit 35835ff71e6e, commit 4d0bf21e3e20, and commit 6dbe70f9ef14.
- Revert to stock hostapd builds that allocate station AIDs starting at 1 where a modified variant is in use.
- Restart affected AP interfaces after patching to clear any lingering firmware fault state.
Patch Information
The fix has been merged into the upstream Linux kernel mt76 driver and backported to stable trees. Four stable-branch commits are referenced by the CVE record, each adding an upper-limit check on station AID within the mt7921 code path. Distribution and OpenWRT users should update to a kernel build that includes these commits.
Workarounds
- Configure hostapd to cap the maximum number of associated stations so that AID allocation cannot exceed 20.
- Avoid the modified MediaTek OpenWRT hostapd variant on mt7921/mt7922 APs until the kernel patch is deployed.
- Operate affected MediaTek hardware in station mode (IFTYPE_STATION) rather than AP mode where feasible, as the flaw does not affect station operation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
