What is the CVSS score of EUVD-2026-38972?

EUVD-2026-38972 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-38972?

Yes, a patch is available for EUVD-2026-38972. Update the affected software to the latest version immediately.

Linux Kernel mt76 EUVD-2026-38972

| CVE-2026-53104 MEDIUM

Memory Leak (CWE-401)

2026-06-24 Linux

GHSA-m2xr-rm39-xmjv

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Module unload requires CAP_SYS_MODULE (root-equivalent), so PR:H is more accurate; no confidentiality or integrity impact per description.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:41 vuln.today

CVSS changed

Jul 23, 2026 - 18:38 NVD

5.5 (MEDIUM)

Patch available

Jun 24, 2026 - 18:02 EUVD

CVE Published

Jun 24, 2026 - 16:30 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 16:30 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix memory leak destroying device

All MT76 rx queues have an associated page_pool even if the queue is not associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the page_pool running mt76_dma_cleanup routine during module unload. Moreover returns pages to the page pool if WED is not enabled for WED RRO queues.

AnalysisAI

Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.

Technical ContextAI

The vulnerability resides in the mt76 kernel driver for MediaTek MT76-series WiFi chipsets (e.g., MT7615, MT7915, MT7986) used widely in routers and embedded SoCs. MT76 uses DMA receive queues, each allocated an associated page_pool - a kernel construct for efficient page recycling via DMA. WED (Wireless Ethernet Dispatch) is a MediaTek SoC hardware offload engine; WED RRO (Reorder/Reassembly Offload) queues are a subset of receive queues used exclusively when WED is enabled, and unlike standard queues they are not attached to NAPI poll handlers. CWE-401 (Missing Release of Memory after Effective Lifetime) applies: mt76_dma_cleanup() assumed all page_pools belonged to NAPI-associated queues and therefore skipped destruction of WED RRO queue page_pools on module unload. Additionally, pages were not returned to the pool for WED RRO queues when WED is not enabled. The fix introduces explicit page_pool_destroy() calls covering all rx queues and adds conditional page return logic gated on WED enablement state. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel release: 7.1, 7.0.10, or 6.18.33 as appropriate for your distribution. Upstream stable-tree commits are available at https://git.kernel.org/stable/c/dcbc13d19bef3326c72f324b10f5a3e5fc4d71de, https://git.kernel.org/stable/c/4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f, and https://git.kernel.org/stable/c/6b470f36616e3448d44b0ef4b1de2a3e3a31b5be. Ubuntu users should apply packages per USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1). If patching is not immediately feasible, the primary compensating control is to avoid unloading the mt76 module on production systems - since the leak accumulates only at teardown, a persistently loaded driver does not continuously leak during normal operation. Restricting CAP_SYS_MODULE to root-only users (already the default on most distributions) limits who can trigger module unloading. Disabling WED offloading at compile time or via driver parameters, if exposed, reduces the WED RRO-specific leak path, but may degrade WiFi throughput on affected hardware.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-38972 vulnerability details – vuln.today

Back

Linux Kernel mt76 EUVD-2026-38972

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code