Answer in brief
CVE-2026-53097 records a Unknown severity vulnerability in wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 <533b1a9fa0128c75e40dd2d2c38a32b4e660741f || >=878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 <180182a3f23ff79430a32ca2c4c1885368ceab48 || >=878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 <aa4a31cd89f4fde5043ac613fe0e27014a60a60b || >=878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 <188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d || >=878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 <c8f62f73bbced3a79894655bdb0b625462d956fc | 533b1a9fa0128c75e40dd2d2c38a32b4e660741f, 180182a3f23ff79430a32ca2c4c1885368ceab48, aa4a31cd89f4fde5043ac613fe0e27014a60a60b, 188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d, c8f62f73bbced3a79894655bdb0b625462d956fc |
| Linux/Linuxgeneric | 6.4 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work.
Quoted source text, attributed separately from HOL analysis.