Skip to main content

Linux Kernel EUVDEUVD-2026-38965

| CVE-2026-53097 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-27w7-x5wj-42p8
Denial Of Service Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Local race during driver teardown means AV:L and AC:H; low privileges to trigger reset/detach give PR:L; realistic impact is kernel DoS (A:H) not confirmed confidentiality/integrity loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 20:38 vuln.today
CVSS changed
Jul 21, 2026 - 18:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()

When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work().

The race condition can occur as follows:

CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work()

| crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work.

AnalysisAI

Use-after-free in the Linux kernel's mt76/mt7996 MediaTek Wi-Fi driver allows a local attacker to trigger memory corruption during PCI device teardown. When the mt7996 device detaches, mt7996_coredump_unregister() frees the crash_data buffer while the dump_work workqueue item may still be running or pending, causing mt7996_mac_dump_work() to dereference freed memory. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hardware-specific race that is difficult to weaponize.

Technical ContextAI

The flaw lives in the mt76 driver stack for MediaTek MT7996 series Wi-Fi 7 PCIe chipsets (CPE cpe:2.3:a:linux:linux). It is a classic CWE-416 use-after-free arising from a race between two kernel paths: the device-removal path (mt7996_pci_remove → mt7996_unregister_device → mt7996_coredump_unregister → vfree of dev->coredump.crash_data) and a concurrently scheduled workqueue item (mt7996_sys_recovery_set → mt7996_reset → queue_work → mt7996_mac_dump_work) that still references crash_data. Because the coredump buffer is deallocated without first synchronizing with the outstanding work item, the worker can dereference a dangling pointer. The upstream fix adds cancel_work_sync() in mt7996_unregister_device() to guarantee dump_work completes before crash_data is freed.

RemediationAI

Apply the vendor-released kernel patch upgrading to a fixed stable release: 6.12.91, 6.18.33, 7.0.10, or 7.1 (or the corresponding backport for your branch via the kernel.org stable commits 180182a3f23ff79430a32ca2c4c1885368ceab48, aa4a31cd89f4fde5043ac613fe0e27014a60a60b, 188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d, and c8f62f73bbced3a79894655bdb0b625462d956fc). Distribution users should install the corresponding update per Ubuntu USN-8566-1 / USN-8567-1 / USN-8568-1 or their vendor equivalent and reboot into the patched kernel. Where immediate patching is impossible, the practical compensating control is to blacklist/unload the mt7996 (mt76) driver module on systems that do not require the MT7996 Wi-Fi adapter, which eliminates the vulnerable code path at the cost of disabling that Wi-Fi interface; additionally restrict local privileged access and avoid scripted device hot-remove/firmware-recovery operations, since the race is triggered during driver detach concurrent with reset.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38965 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy