CVE-2026-53100 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix deadlock in remain-on-channel mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel() while already holding dev->mutex. Since mt76_set_channel() also acquires dev->mutex, this results in a deadlock. Use __mt76_set_channel() instead of mt76_set_channel(). Add cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel() to prevent a secondary deadlock with the mac_work workqueue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd
https://git.kernel.org/stable/c/6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e
https://git.kernel.org/stable/c/7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f

History

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix deadlock in remain-on-channel mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel() while already holding dev->mutex. Since mt76_set_channel() also acquires dev->mutex, this results in a deadlock. Use __mt76_set_channel() instead of mt76_set_channel(). Add cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel() to prevent a secondary deadlock with the mac_work workqueue.
Title		wifi: mt76: fix deadlock in remain-on-channel
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd https://git.kernel.org/stable/c/6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e https://git.kernel.org/stable/c/7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:30:37.216Z

Updated: 2026-06-24T16:30:37.216Z

Reserved: 2026-06-09T07:44:35.384Z

Link: CVE-2026-53100

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53100", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.384Z", "datePublished": "2026-06-24T16:30:37.216Z", "dateUpdated": "2026-06-24T16:30:37.216Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-24T16:30:37.216Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: fix deadlock in remain-on-channel\n\nmt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel()\nwhile already holding dev->mutex. Since mt76_set_channel() also acquires\ndev->mutex, this results in a deadlock.\n\nUse __mt76_set_channel() instead of mt76_set_channel().\nAdd cancel_delayed_work_sync() for mac_work before acquiring the mutex\nin mt76_remain_on_channel() to prevent a secondary deadlock with the\nmac_work workqueue."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/channel.c"], "versions": [{"version": "a8f424c1287cc79a06c21816658feea87dfcb83f", "lessThan": "5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd", "status": "affected", "versionType": "git"}, {"version": "a8f424c1287cc79a06c21816658feea87dfcb83f", "lessThan": "7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f", "status": "affected", "versionType": "git"}, {"version": "a8f424c1287cc79a06c21816658feea87dfcb83f", "lessThan": "6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/channel.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd"}, {"url": "https://git.kernel.org/stable/c/7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f"}, {"url": "https://git.kernel.org/stable/c/6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e"}], "title": "wifi: mt76: fix deadlock in remain-on-channel", "x_generator": {"engine": "bippy-1.2.0"}}}}