Executive brief
A flaw was discovered in the Linux kernel's MediaTek Wi-Fi driver (mt7925) that can cause the system to hang or become unresponsive. This occurs due to a 'deadlock' where two internal processes wait for each other to release a lock during the removal of a wireless station. In practice, this could lead to a denial-of-service, requiring a system reboot to restore wireless functionality.
Technical details
A deadlock exists in the mt7925 driver within the mt7925_roc_abort_sync function. The issue arises because roc_work() holds the dev->mt76.mutex while mt7925_roc_abort_sync() calls cancel_work_sync(), which waits for roc_work() to complete. If the caller of mt7925_roc_abort_sync() already holds the same mutex (common during station removal flows like mt76_sta_remove), a circular dependency occurs. An attacker or specific system conditions could trigger this during network management operations to cause a kernel hang (DoS). The fix replaces cancel_work_sync() with cancel_work() and ensures proper state bit checking to avoid the synchronous wait while holding the mutex.
Affected products
- Linux Linux Kernel 6.11.2 through 6.12, 7.0.10, 7.1
Timeline
- 2026-06-24: disclosed: CVE-2026-53103 published
- 2026-06-24: advisory