Skip to main content

Linux Kernel mt76 CVE-2026-53102

| EUVDEUVD-2026-38970 MEDIUM
Memory Leak (CWE-401)
2026-06-24 Linux GHSA-998c-5h7q-5rrg
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local low-privilege shell access
  2. Delivery
    Load or interact with mt76 WiFi driver
  3. Exploit
    Repeatedly trigger MCU station key or WED update operations
  4. Install
    Force error return before skb transmission
  5. C2
    Leaked skb accumulates in kernel heap
  6. Execute
    Kernel memory exhausted
  7. Impact
    System instability or denial of service

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Exploitation requires local shell access with low-privilege credentials (CVSS PR:L) on a Linux system that has a MediaTek mt76-series WiFi chipset physically present and the mt76 kernel driver loaded. The leak is triggered only when specific MCU firmware communication functions (mt76_connac_mcu_sta_wed_update or mt76_connac_mcu_sta_key_tlv) encounter an error condition before dispatching the allocated skb. Systems without mt76 hardware are completely unaffected regardless of kernel version. Remote exploitation is not possible (CVSS AV:L). The impact is limited to gradual memory exhaustion; no confidentiality or integrity compromise is possible via this flaw.
Impact

Real-world risk is low. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (score 5.5) accurately reflects the constraint to local authenticated access with impact limited to availability via gradual kernel memory exhaustion. EPSS sits at 0.16% in the 5th percentile, indicating almost no community-observed exploitation pressure. There is no CISA KEV listing, no public proof-of-concept, and no reported active exploitation - the issue was surfaced entirely through prototype static analysis and manual code review. The 'Information Disclosure' tag in the source intelligence data appears to be a misclassification; the CVSS vector and description confirm C:N/I:N/A:H, meaning only availability is affected. Hardware specificity further limits blast radius: systems without MediaTek mt76 WiFi hardware are entirely unexposed regardless of kernel version.
Exploit ScenarioDerived

A local user with low-privilege shell access on a Linux system equipped with a MediaTek mt76 WiFi adapter could repeatedly invoke WiFi association or key management operations that trigger failures in mt76_connac_mcu_sta_key_tlv() or mt76_connac_mcu_sta_wed_update(), each iteration leaking a kernel skb allocation. Sustained repetition over time could exhaust kernel memory and induce system instability or an out-of-memory condition. No public exploit code exists; the issue was found via static analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Kernel memory exhaustion in the Linux mt76 WiFi driver allows a local low-privileged user on affected hardware to gradually degrade system availability. The functions mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail before the allocated socket buffer (skb) is handed off to mt76_mcu_skb_send_msg() for transmission and cleanup, leaving the skb permanently leaked. With EPSS at the 5th percentile, no KEV listing, and discovery solely via static analysis, this is a stability maintenance concern rather than an active security threat.

RemediationAI

Apply the upstream stable kernel patches available at https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42 and https://git.kernel.org/stable/c/eb466406d2094deefadc2cd6ddb4f6eeb086d1b4, which add explicit skb cleanup in the affected error paths. Ubuntu users should apply the kernel updates detailed in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1). As a compensating control for systems where patching is delayed, blacklisting the mt76 driver module (adding 'blacklist mt76' to /etc/modprobe.d/) will prevent the vulnerable code paths from being reachable, with the trade-off of disabling all MediaTek mt76-based WiFi adapters on the system. No workaround is needed on systems without mt76 hardware.

Affected VersionsENISA

Linux patch: 0
Linux patch: 7.1
Linux 5.18
Linux patch: 7.0.10
Linux 6683d988089ce0e80bd859a9493333b6b272420e <c41075ce8cf05ed8c0e7b7efef000dce548ffc42
Linux 6683d988089ce0e80bd859a9493333b6b272420e <eb466406d2094deefadc2cd6ddb4f6eeb086d1b4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the mt76 wireless driver subsystem of the Linux kernel, which provides support for MediaTek mt76-series WiFi chipsets (including mt7615, mt7915, mt7921, and mt7996 families). The affected code path involves the MCU (Microcontroller Unit) firmware communication layer: mt76_connac_mcu_alloc_sta_req() allocates a kernel socket buffer (skb) for building firmware messages. Under the normal path, mt76_mcu_skb_send_msg() both transmits and frees the skb. However, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() can return error codes before reaching the send function, leaving the skb unreleased. CWE-401 (Missing Release of Memory after Effective Lifetime) precisely describes this class of error-path resource leak. A structurally identical prior fix was applied in commit 7c0f63fe37a5 for mt7996_mcu_sta_key_tlv. Affected CPE: cpe:2.3:a:linux:linux across stable branches from commit 6683d988089ce0e80bd859a9493333b6b272420e through the fix commits.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local driver interaction requires low-privilege access; only availability is impacted via kernel memory exhaustion with no confidentiality or integrity effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked.

Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path.

Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Medium
MediaTek mt76 WiFi common in consumer and embedded Linux devices
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53102 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373394 REF https://git.kernel.org/stable/c/25af8229133c8dc69b12721ad84165cced83caed REF https://git.kernel.org/stable/c/7de35b99503012e57bec027e98ed53f881518b5b REF https://git.kernel.org/stable/c/8527ac1bce87aaabde6755e8e6eb2a9f439d1292 REF https://git.kernel.org/stable/c/a2af91af9536922edc3f63de90c3f1fe9db71717 REF https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42 REF https://git.kernel.org/stable/c/eb466406d2094deefadc2cd6ddb4f6eeb086d1b4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy