Skip to main content

Linux Kernel mt7925 EUVDEUVD-2026-38971

| CVE-2026-53103 MEDIUM
Improper Locking (CWE-667)
2026-06-24 Linux GHSA-jp54-xjfc-9fqx
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only deadlock triggered by low-privilege station removal; no confidentiality or integrity impact, availability-only denial of service.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.8 MEDIUM
AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 18:23 vuln.today
CVSS changed
Jul 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible.

This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() -> mt7925_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex.

This avoids the mutex deadlock and preserves exactly-once work ownership.

AnalysisAI

Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.

Technical ContextAI

CWE-667 (Improper Locking) describes scenarios where a lock acquisition path creates a circular wait. Here, the mt7925 WiFi driver's Remain-on-Channel (RoC) abort path - invoked during station removal via the call chain mt76_sta_state() → mt76_sta_remove() → mt7925_mac_sta_remove_link() → mt7925_mac_link_sta_remove() → mt7925_roc_abort_sync() - calls cancel_work_sync() to wait for roc_work() to finish. However, roc_work() itself holds dev->mt76.mutex, and if mt7925_roc_abort_sync() is invoked from a context that already owns that mutex, both threads block permanently. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, scoped specifically to kernels that include the mt7925 driver (introduced at commit 45064d19fd3af6aeb0887b35b5564927980cf150). The MediaTek MT7925 is a modern WiFi 6E/7 chipset appearing in consumer and enterprise laptops.

RemediationAI

The primary fix is to upgrade to a patched kernel version: 6.18.33, 7.0.10, or 7.1 per EUVD-sourced version data. The three upstream stable commits are available at https://git.kernel.org/stable/c/dd08ca3f092f4185ece69ce2a835c23198b1628a, https://git.kernel.org/stable/c/2d8e0053bca29143ace51e08c980ff076844a4b0, and https://git.kernel.org/stable/c/153bcba36c87a1ba555b57b6c49028d5812f895b. Ubuntu users should apply updates referenced in USN-8568-1 and USN-8566-1. For systems where kernel upgrade is not immediately possible, a compensating control is to blacklist or unload the mt7925 driver (modprobe -r mt7925u or mt7925e as applicable), disabling WiFi functionality - this eliminates the vulnerable code path entirely at the cost of wireless connectivity. Alternatively, network administrators in managed environments can restrict physical and logical access to affected endpoints to reduce the local-access prerequisite.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Micro 6.2 Affected
SUSE Linux Micro Extras 6.2 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected

Share

EUVD-2026-38971 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy