High 7.8Published Jun 24, 2026

CVE-2026-53098wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()

Updated under an hour ago (Oct 28, 2026, 10:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7915_pci_remove() | mt7915_sys_recovery_set() mt7915_unregister_device() | mt7915_reset() mt7915_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7915_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7915_unregister_device() to synchronize with any pending or executing dump work.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4bf3f4755611e3ae4cca58469e3c1d73be9c8093 before 55159f1fa30bef03e01af469823c1de103a4a884; from 4dbcb9125cc3e10a6d879c10e4f5816d05a87c49 before 6d5202409467d621b6d1dfd7fc7dadb997fe66d2; from 4dbcb9125cc3e10a6d879c10e4f5816d05a87c49 before e6856af8a22a8e2cd18241a465ed00c2301b3a5e; from 4dbcb9125cc3e10a6d879c10e4f5816d05a87c49 before 6b7cbb13c838cf2a5f2e7be0e96fe15250087939; from 4dbcb9125cc3e10a6d879c10e4f5816d05a87c49 before 21ce6d867867645fff0ef657be18f61d9f39dcd8; from 4dbcb9125cc3e10a6d879c10e4f5816d05a87c49 before 1146d0946b5358fad24812bd39d68f31cd40cc34	CNA record
linux linux_kernel linux:linux_kernel	from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/55159f1fa30bef03e01af469823c1de103a4a884
https://git.kernel.org/stable/c/6d5202409467d621b6d1dfd7fc7dadb997fe66d2	patch
https://git.kernel.org/stable/c/e6856af8a22a8e2cd18241a465ed00c2301b3a5e	patch
https://git.kernel.org/stable/c/6b7cbb13c838cf2a5f2e7be0e96fe15250087939	patch
https://git.kernel.org/stable/c/21ce6d867867645fff0ef657be18f61d9f39dcd8	patch
https://git.kernel.org/stable/c/1146d0946b5358fad24812bd39d68f31cd40cc34	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.