In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
When the mt7915 pci chip is detaching, the mt7915_crash_data is
released in mt7915_coredump_unregister(). However, the work item
dump_work may still be running or pending, leading to UAF bugs
when the already freed crash_data is dereferenced again in
mt7915_mac_dump_work().
The race condition can occur as follows:
CPU 0 (removal path) | CPU 1 (workqueue)
mt7915_pci_remove() | mt7915_sys_recovery_set()
mt7915_unregister_device() | mt7915_reset()
mt7915_coredump_unregister() | queue_work()
vfree(dev->coredump.crash_data) | mt7915_mac_dump_work()
| crash_data-> // UAF
Fix this by ensuring dump_work is properly canceled before
the crash_data is deallocated. Add cancel_work_sync() in
mt7915_unregister_device() to synchronize with any pending
or executing dump work.
References
Configurations
Configuration 1 (hide)
|
History
21 Jul 2026, 18:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CWE | CWE-416 | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| References | () https://git.kernel.org/stable/c/1146d0946b5358fad24812bd39d68f31cd40cc34 - Patch | |
| References | () https://git.kernel.org/stable/c/21ce6d867867645fff0ef657be18f61d9f39dcd8 - Patch | |
| References | () https://git.kernel.org/stable/c/6b7cbb13c838cf2a5f2e7be0e96fe15250087939 - Patch | |
| References | () https://git.kernel.org/stable/c/6d5202409467d621b6d1dfd7fc7dadb997fe66d2 - Patch | |
| References | () https://git.kernel.org/stable/c/e6856af8a22a8e2cd18241a465ed00c2301b3a5e - Patch |
24 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-24 17:17
Updated : 2026-07-21 18:21
NVD link : CVE-2026-53098
Mitre link : CVE-2026-53098
CVE.ORG link : CVE-2026-53098
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free