Skip to main content

Linux Kernel EUVDEUVD-2026-38969

| CVE-2026-53101 MEDIUM
Improper Locking (CWE-667)
2026-06-24 Linux GHSA-vhcc-wfm4-93ww
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only race condition (AV:L) triggered by a low-privileged station removal operation (PR:L); impact is purely availability via kernel deadlock (A:H), with no data exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.8 MEDIUM
AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 20:42 vuln.today
CVSS changed
Jul 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync

roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible.

This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() -> mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex.

This avoids the mutex deadlock and preserves exactly-once work ownership.

AnalysisAI

Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.

Technical ContextAI

The affected code resides in the mt76/mt7921 driver, which provides Linux kernel support for MediaTek MT7921 802.11ax WiFi chipsets (CPE: cpe:2.3:a:linux:linux). The root cause is CWE-667 (Improper Locking): mt7921_roc_abort_sync() calls cancel_work_sync() to synchronously wait for roc_work() to complete. However, roc_work() acquires dev->mt76.mutex during its execution, and the station-removal call path that leads to mt7921_roc_abort_sync() also holds dev->mt76.mutex before calling in. This produces a mutual-wait cycle - cancel_work_sync() blocks until roc_work() exits, but roc_work() cannot proceed or release its mutex lock while cancel_work_sync() occupies the same lock. The fix restructures work ownership semantics to ensure exactly-once execution without re-entrant mutex acquisition across the cancellation boundary. The vulnerability was introduced at commit 352d966126e66d825244f1185eb9f2d904c83dd4 in the Linux 6.9 development cycle.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel: version 6.18.33, 7.0.10, or Linux 7.1 post-patch, as documented in EUVD-2026-38969. Upstream stable fixes are available at git.kernel.org stable commits 35180c772f5e11e2fa4d80d3dfd50906cb6d9646, 91e77840bf13de3add125060cf8b32ca24a52c8c, d5059e52fd8bc624ec4255c9fa01a266513d126b, and b4faaa617af3f4173e64169b0ec1af8f9c5bca10. Ubuntu users should apply USN-8568-1 or USN-8566-1 via standard package management. Where immediate patching is not feasible, blacklisting the mt7921 kernel module (adding 'blacklist mt7921e' and 'blacklist mt7921s' to /etc/modprobe.d/) eliminates exposure entirely but disables MT7921 WiFi functionality - acceptable only if wired connectivity is available. No generic network-level mitigation applies given the local attack vector.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38969 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy