CVE-2026-53102
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the Linux kernel, in the mt76 driver, mt76_connac_mcu_alloc_sta_req() allocates an skb that should be freed by mt76_mcu_skb_send_msg(). However, if an intermediate function (mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv()) fails before sending, the allocated skb leaks.
Risk Assessment
Memory leak can lead to resource exhaustion and potential denial of service (DoS) on systems using this WiFi driver.
Recommendation
Apply the Linux kernel patch that explicitly frees the skb in error paths. Update the kernel to a version containing the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked. Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path. Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change. Compile tested only. Issue found using a prototype static analysis tool and code review.