CVE-2026-53101
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the Linux kernel, a potential deadlock was found in the mt76 mt7921 WiFi driver in the mt7921_roc_abort_sync function. This function can deadlock on cancel_work_sync() when roc_work() holds dev->mt76.mutex and the caller already owns the same mutex. The deadlock occurs during station removal in the path mt76_sta_remove -> mt7921_mac_sta_remove -> mt7921_roc_abort_sync.
Risk Assessment
The risk is that the system may hang (deadlock) during WiFi station removal operations, leading to driver unresponsiveness and potential disruption of wireless network functionality.
Recommendation
Update the Linux kernel to a version containing the fix that avoids the deadlock by proper lock management in mt7921_roc_abort_sync.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() -> mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership.