PT-2026-51991 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53097

NVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix use-after-free bugs in mt7996 mac dump work()

When the mt7996 pci chip is detaching, the mt7996 crash data is released in mt7996 coredump unregister(). However, the work item dump work may still be running or pending, leading to UAF bugs when the already freed crash data is dereferenced again in mt7996 mac dump work().

The race condition can occur as follows:

CPU 0 (removal path) | CPU 1 (workqueue) mt7996 pci remove() | mt7996 sys recovery set() mt7996 unregister device() | mt7996 reset() mt7996 coredump unregister() | queue work() vfree(dev->coredump.crash data) | mt7996 mac dump work() | crash data-> // UAF

Fix this by ensuring dump work is properly canceled before the crash data is deallocated. Add cancel work sync() in mt7996 unregister device() to synchronize with any pending or executing dump work.

Related Identifiers

CVE-2026-53097

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-53097 · Security Note
• https://git.kernel.org/stable/c/180182a3f23ff79430a32ca2c4c1885368ceab48 · Note
• https://git.kernel.org/stable/c/aa4a31cd89f4fde5043ac613fe0e27014a60a60b · Note
• https://git.kernel.org/stable/c/c8f62f73bbced3a79894655bdb0b625462d956fc · Note
• https://git.kernel.org/stable/c/188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d · Note