CVE-2026-53097: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: fix use-after-free bugs in mt7996macdumpwork()
When the mt7996 pci chip is detaching, the mt7996crashdata is released in mt7996coredumpunregister(). However, the work item dumpwork may still be running or pending, leading to UAF bugs when the already freed crashdata is dereferenced again in mt7996macdumpwork().
The race condition can occur as follows:
CPU 0 (removal path) | CPU 1 (workqueue) mt7996pciremove() | mt7996sysrecoveryset() mt7996unregisterdevice() | mt7996reset() mt7996coredumpunregister() | queuework() vfree(dev->coredump.crashdata) | mt7996macdumpwork() | crashdata-> // UAF
Fix this by ensuring dumpwork is properly canceled before the crashdata is deallocated. Add cancelworksync() in mt7996unregisterdevice() to synchronize with any pending or executing dump work.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Call cancel_work_sync() for dump_work before mt7996_unregister_device() releases mt7996_coredump.crash_data, ensuring pending or executing mt7996_mac_dump_work() completes before the crash data is deallocated.