Skip to main content

Linux Kernel mt76 EUVDEUVD-2026-38968

| CVE-2026-53100 MEDIUM
Improper Locking (CWE-667)
2026-06-24 Linux GHSA-26qq-fq9w-jrj5
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privileged trigger, hardware-specific mutex deadlock; no confidentiality or integrity impact, only availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 20:42 vuln.today
CVSS changed
Jul 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: fix deadlock in remain-on-channel

mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel() while already holding dev->mutex. Since mt76_set_channel() also acquires dev->mutex, this results in a deadlock.

Use __mt76_set_channel() instead of mt76_set_channel(). Add cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel() to prevent a secondary deadlock with the mac_work workqueue.

AnalysisAI

Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.

Technical ContextAI

The mt76 driver (cpe:2.3:a:linux:linux) supports MediaTek 802.11 WiFi chipsets in the Linux kernel. CWE-667 (Improper Locking) describes the root cause: mt76_remain_on_channel() and mt76_roc_complete() each hold dev->mutex before calling mt76_set_channel(), which internally attempts to re-acquire the same mutex, producing a classic recursive-mutex deadlock. A secondary deadlock vector exists with the mac_work workqueue if it fires while the mutex is held. The fix replaces mt76_set_channel() with its non-locking variant __mt76_set_channel() and adds cancel_delayed_work_sync() before mutex acquisition in mt76_remain_on_channel() to drain the workqueue safely.

RemediationAI

The primary remediation is upgrading to a patched Linux kernel: version 6.18.33 or 7.0.10 for current stable branches, or 7.1 for the mainline release, as documented at https://git.kernel.org/stable/c/5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd, https://git.kernel.org/stable/c/7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f, and https://git.kernel.org/stable/c/6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e. Ubuntu users should apply the updates referenced in USN-8568-1 and USN-8566-1. As a compensating control on systems that cannot be patched immediately, unloading the mt76 kernel module ('modprobe -r mt76') eliminates the attack surface entirely, at the cost of disabling MediaTek WiFi functionality. Restricting local user access to WiFi management interfaces (e.g., via MAC policy or by limiting nl80211 socket access) reduces but does not eliminate exposure.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38968 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy