Executive brief
The Linux kernel's MT7615 WiFi driver had a deadlock vulnerability in its suspend handler. When a device enters sleep mode, the suspend function would wait for background work tasks while holding a critical lock that those same tasks need to acquire, causing the system to hang. This could prevent a device from suspending properly or resuming from sleep.
Technical details
The vulnerability is a classic lock-ordering deadlock (CWE-833) in the mt7615_suspend() function within the MT76 wireless driver. The suspend path acquired the mt76 mutex and then called cancel_delayed_work_sync() to wait for mac_work to complete. However, mac_work's handler (mt7615_mac_work()) also attempts to acquire the same mutex at its entry point. If mac_work was already running when suspend was called, the suspend path would deadlock waiting for a work queue it was blocking via mutex ownership. The fix reorders operations to flush and cancel scan_work and mac_work before acquiring the mutex, preventing the circular wait condition. This issue affects the MT7615 wireless chipset support in the Linux kernel.
Affected products
- Linux Linux Kernel affected versions in mt7615 driver (5.0 and later based on stable tree targets)
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-09-07: patched: Fix committed upstream and backported to stable kernels
- 2026-06-12: other: Original patch authored by Runyu Xiao