CVE-2026-53097
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's mt76 (mt7996) WiFi driver, a use-after-free bug occurs during PCI chip detachment. The mt7996_mac_dump_work() function may dereference already freed crash_data because dump_work is not canceled before memory deallocation.
Risk Assessment
An attacker could exploit this bug to access freed kernel memory, potentially leading to arbitrary code execution or system crash.
Recommendation
Apply the Linux kernel patch that adds cancel_work_sync() before freeing crash_data to synchronize with pending or executing work items.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work.