Executive brief
A vulnerability in the MediaTek mt76 wireless driver within the Linux kernel could cause a system deadlock. This occurs when the driver attempts to change Wi-Fi channels, potentially leading to a complete system freeze or loss of wireless connectivity. Users may experience a lack of responsiveness or a forced reboot during certain wireless operations.
Technical details
A deadlock was identified in the mt76 wireless driver's channel management logic. Specifically, mt76_remain_on_channel() and mt76_roc_complete() were found to call mt76_set_channel() while already holding the dev->mutex lock. Because mt76_set_channel() also attempts to acquire the same mutex, a recursive deadlock occurs. Additionally, a secondary deadlock risk existed with the mac_work workqueue. The fix involves using the non-locking __mt76_set_channel() variant and ensuring delayed work is canceled before acquiring the mutex. This affects Linux kernel versions from 6.14 up to the fixed releases in the 6.18.x, 7.0.x, and 7.1+ branches.
Affected products
- Linux Linux Kernel 6.14 to 7.1
Timeline
- 2026-06-24: advisory: CVE-2026-53100 published by NVD
- 2026-05-23: patched: Fix committed to stable kernel trees