CVE-2026-53105 wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: prevent NULL vif dereference in mt7925macwritetxwi Check for a NULL vif before accessing ieee80211vifismldvif to avoid a potential kernel panic in scenarios where vif might not be initialized...

EUVD-2026-38971

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix potential deadlock in mt7925rocabortsync rocabortsync can deadlock with rocwork. rocwork holds dev-mt76.mutex, while cancelworksync waits for rocwork to finish. If the caller already owns the same mutex,...

CVE-2026-53103

CVE-2026-53103 affects the Linux kernel Wi-Fi subsystem, specifically the mt7925_roc_abort_sync path. The issue is a potential deadlock: roc_abort_sync() may call cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex, and if the caller already owns that mutex, both s...

EUVD-2026-38972

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak destroying device All MT76 rx queues have an associated pagepool even if the queue is not associated to a NAPI e.g. WED RRO queues with WED enabled. Destroy the pagepool running mt76dmacleanup routine...

CVE-2026-53104

CVE-2026-53104 concerns Linux kernel code for MT76 wireless (wifi) where a memory leak occurs in MT76 RX queue cleanup and page_pool handling. The vulnerability arises when destroying the device, requiring mt76_dma_cleanup to run during module unload and ensuring pages are returned to the page po...

CVE-2026-53103 wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix potential deadlock in mt7925rocabortsync rocabortsync can deadlock with rocwork. rocwork holds dev-mt76.mutex, while cancelworksync waits for rocwork to finish. If the caller already owns the same mutex,...

CVE-2026-53104 wifi: mt76: Fix memory leak destroying device

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak destroying device All MT76 rx queues have an associated pagepool even if the queue is not associated to a NAPI e.g. WED RRO queues with WED enabled. Destroy the pagepool running mt76dmacleanup routine...

CVE-2026-53103 wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix potential deadlock in mt7925rocabortsync rocabortsync can deadlock with rocwork. rocwork holds dev-mt76.mutex, while cancelworksync waits for rocwork to finish. If the caller already owns the same mutex,...

CVE-2026-53102

The CVE-2026-53102 issue affects the Linux kernel wifi MT76 driver. It describes a memory leak in skb handling inside mt76_connac_mcu_alloc_sta_req(): if mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() fail before mt76_mcu_skb_send_msg() completes, the allocated skb is leaked. T...

CVE-2026-53102 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak after mt76connacmcuallocstareq mt76connacmcuallocstareq allocates an skb which is expected to be freed eventually by mt76mcuskbsendmsg. However, currently if an intermediate function fails before...

CVE-2026-53101 wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix potential deadlock in mt7921rocabortsync rocabortsync can deadlock with rocwork. rocwork holds dev-mt76.mutex, while cancelworksync waits for rocwork to finish. If the caller already owns the same mutex,...

CVE-2026-53101

CVE-2026-53101 is a Linux kernel issue affecting the wifi mt76/mt7921 path. The root cause is a potential mutex deadlock between mt7921_roc_abort_sync and roc_work: roc_work() holds dev->mt76.mutex while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the mutex, b...

EUVD-2026-38968

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix deadlock in remain-on-channel mt76remainonchannel and mt76roccomplete call mt76setchannel while already holding dev-mutex. Since mt76setchannel also acquires dev-mutex, this results in a deadlock. Use mt76setchann...

CVE-2026-53101

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix potential deadlock in mt7921rocabortsync rocabortsync can deadlock with rocwork. rocwork holds dev-mt76.mutex, while cancelworksync waits for rocwork to finish. If the caller already owns the same mutex,...

CVE-2026-53100

CVE-2026-53100 affects the Linux kernel mt76 wireless driver. The deadlock occurs when remain-on-channel logic calls mt76_set_channel() while dev->mutex is already held by remain_on_channel/roc_complete, since mt76_set_channel() also locks the mutex. The fix replaces mt76_set_channel() with __...

CVE-2026-53100 wifi: mt76: fix deadlock in remain-on-channel

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix deadlock in remain-on-channel mt76remainonchannel and mt76roccomplete call mt76setchannel while already holding dev-mutex. Since mt76setchannel also acquires dev-mutex, this results in a deadlock. Use mt76setchann...

CVE-2026-53101 wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix potential deadlock in mt7921rocabortsync rocabortsync can deadlock with rocwork. rocwork holds dev-mt76.mutex, while cancelworksync waits for rocwork to finish. If the caller already owns the same mutex,...

EUVD-2026-38965

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996macdumpwork When the mt7996 pci chip is detaching, the mt7996crashdata is released in mt7996coredumpunregister. However, the work item dumpwork may still be running or pending,...

CVE-2026-53093

Technical details about CVE-2026-53093 (Linux kernel wifi brcmfmac error pointer handling) are not present in the provided connected documents. The available sources reference the CVE but do not disclose affected versions, root cause, impact, or fixes here. Monitor for updates.

CVE-2026-53093 wifi: brcmfmac: Fix error pointer dereference

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix error pointer dereference The function brcmfchipaddcore can return an error pointer and is not checked. Add checks for error pointer. Detected by Smatch:...