Skip to main content

Linux Kernel mt76 EUVDEUVD-2026-38970

| CVE-2026-53102 MEDIUM
Memory Leak (CWE-401)
2026-06-24 Linux GHSA-998c-5h7q-5rrg
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local driver interaction requires low-privilege access; only availability is impacted via kernel memory exhaustion with no confidentiality or integrity effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 21, 2026 - 18:24 vuln.today
CVSS changed
Jul 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked.

Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path.

Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change.

Compile tested only. Issue found using a prototype static analysis tool and code review.

AnalysisAI

Kernel memory exhaustion in the Linux mt76 WiFi driver allows a local low-privileged user on affected hardware to gradually degrade system availability. The functions mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail before the allocated socket buffer (skb) is handed off to mt76_mcu_skb_send_msg() for transmission and cleanup, leaving the skb permanently leaked. With EPSS at the 5th percentile, no KEV listing, and discovery solely via static analysis, this is a stability maintenance concern rather than an active security threat.

Technical ContextAI

The vulnerability resides in the mt76 wireless driver subsystem of the Linux kernel, which provides support for MediaTek mt76-series WiFi chipsets (including mt7615, mt7915, mt7921, and mt7996 families). The affected code path involves the MCU (Microcontroller Unit) firmware communication layer: mt76_connac_mcu_alloc_sta_req() allocates a kernel socket buffer (skb) for building firmware messages. Under the normal path, mt76_mcu_skb_send_msg() both transmits and frees the skb. However, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() can return error codes before reaching the send function, leaving the skb unreleased. CWE-401 (Missing Release of Memory after Effective Lifetime) precisely describes this class of error-path resource leak. A structurally identical prior fix was applied in commit 7c0f63fe37a5 for mt7996_mcu_sta_key_tlv. Affected CPE: cpe:2.3:a:linux:linux across stable branches from commit 6683d988089ce0e80bd859a9493333b6b272420e through the fix commits.

RemediationAI

Apply the upstream stable kernel patches available at https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42 and https://git.kernel.org/stable/c/eb466406d2094deefadc2cd6ddb4f6eeb086d1b4, which add explicit skb cleanup in the affected error paths. Ubuntu users should apply the kernel updates detailed in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1). As a compensating control for systems where patching is delayed, blacklisting the mt76 driver module (adding 'blacklist mt76' to /etc/modprobe.d/) will prevent the vulnerable code paths from being reachable, with the trade-off of disabling all MediaTek mt76-based WiFi adapters on the system. No workaround is needed on systems without mt76 hardware.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-38970 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy