CVE-2026-53102

What it actually does

This vulnerability is a memory leak in the Linux kernel mt76 Wi-Fi driver family. When certain MediaTek mt76 station update or key-handling operations fail before an allocated socket buffer is submitted to the MCU send path, the error path does not free the allocated skb. Repeated triggering of those failure paths can consume kernel memory over time, potentially degrading wireless networking or causing broader system instability. The flaw is not described as enabling code execution, privilege escalation, or data disclosure; the primary technical impact is resource exhaustion in affected kernel configurations using the vulnerable mt76 driver code.

Why it matters to the business

Systems using affected Linux kernels with vulnerable MediaTek mt76 Wi-Fi driver support could experience degraded wireless connectivity, instability, or denial of service if the leak is triggered repeatedly. This is most relevant to endpoints, embedded Linux devices, access points, routers, and appliances that rely on mt76-supported Wi-Fi chipsets. Current public risk signals are low: EPSS is very low, it is not in the CISA KEV catalog, it is not known to be used in ransomware campaigns, and no public exploit maturity is reported. Organizations should still address it through normal kernel update processes, especially for Wi-Fi-dependent or embedded fleets where instability can affect availability.

How an attack unfolds

An attacker would need a practical way to cause the vulnerable mt76 driver to enter the failing station update or key TLV error paths repeatedly. In a realistic scenario, this would likely require local proximity to the wireless interface, control over Wi-Fi association or authentication conditions, or the ability to influence driver state so that mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() fails after an skb has been allocated but before it is sent. Each successful trigger leaks a small amount of kernel memory. Repeated triggering could accumulate leaked memory and eventually cause degraded Wi-Fi operation, driver resets, out-of-memory behavior, or system instability. There is no indication from the provided data that exploitation is currently widespread, weaponized, or associated with named threat actors.

How to fix it

Apply a Linux kernel update that includes the upstream fix for the mt76 driver memory leak, or apply the vendor/distribution kernel package that backports the fix. Because no exact affected products or fixed package versions were provided, use the relevant Linux distribution, device vendor, or kernel maintainer advisory to identify the corrected kernel build. For systems that cannot be immediately patched, reduce exposure by disabling unused mt76 Wi-Fi interfaces, disabling the vulnerable driver where not required, restricting physical/radio access where feasible, and monitoring for kernel memory pressure or repeated Wi-Fi driver errors. Embedded and appliance vendors should incorporate the fixed kernel commit into firmware builds and validate Wi-Fi association, roaming, and key-management failure paths.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package or firmware version includes the mt76 fix that frees the skb on mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() error paths. Validate that affected systems actually use mt76-supported hardware and that the mt76 driver modules are loaded before prioritizing testing. Review kernel changelogs or distribution advisories for a fix referencing mt76, mt76_connac_mcu_alloc_sta_req(), mt76_connac_mcu_sta_wed_update(), mt76_connac_mcu_sta_key_tlv(), or skb free handling. After patching, reboot into the fixed kernel and confirm the active kernel version, loaded mt76 modules, and absence of recurring mt76-related kernel errors during Wi-Fi association and key-management tests.

Typical attack path

1. Identify a Linux system or embedded device using an affected kernel with the mt76 Wi-Fi driver enabled and active.
2. Position near the wireless interface or otherwise influence Wi-Fi station/key-management activity involving the mt76 driver.
3. Trigger conditions that cause mt76 station update or key TLV handling to fail after skb allocation but before the message is sent.
4. Repeat the trigger many times to accumulate leaked kernel memory.
5. Cause degraded wireless behavior, driver instability, or broader denial-of-service conditions if memory pressure becomes severe.

How to detect it

Because this is a kernel memory leak rather than a compromise primitive with unique payloads, there may be no definitive forensic indicator proving exploitation. Detection should focus on evidence of repeated triggering and resulting resource exhaustion. Review kernel logs from dmesg, journald, syslog, and appliance firmware logs for mt76 driver errors, repeated station update or key-management failures, wireless interface resets, skb allocation/free anomalies, memory allocation failures, and OOM-killer activity. Correlate these events with spikes in Wi-Fi association, reassociation, roaming, or authentication failures from wireless controller, hostapd, wpa_supplicant, NetworkManager, or device-specific wireless logs. Look for abnormal memory growth over time on systems with active mt76 modules, especially when paired with repeated Wi-Fi events and no corresponding workload increase. If an incident is suspected, preserve kernel logs, wireless daemon logs, firmware logs, memory-pressure telemetry, module lists, kernel version data, and packet captures around the time of instability. No named threat actors or campaigns are currently associated with this CVE in the provided data.

• mt76_connac_mcu_alloc_sta_req
• mt76_connac_mcu_sta_wed_update
• mt76_connac_mcu_sta_key_tlv
• mt76
• skb
• Out of memory
• oom-killer
• invoked oom-killer
• page allocation failure
• Memory allocation failure
• wlan0: deauthenticating
• wlan0: disassociated
• wlan0: authentication failed
• wpa_supplicant
• hostapd
• NetworkManager
• mt7996

What your security team should do

• Inventory Linux systems, embedded devices, access points, and appliances using MediaTek mt76 Wi-Fi chipsets or loaded mt76 kernel modules.
• Prioritize patching for Wi-Fi-dependent devices, internet-managed appliances with wireless functionality, and embedded fleets where kernel instability would affect operations.
• Track vendor and Linux distribution advisories for the fixed kernel or firmware version because exact fixed versions were not provided in the input.
• Where patching is delayed, disable unused mt76 Wi-Fi interfaces or unload/blacklist mt76 driver modules when wireless functionality is not required.
• Monitor kernel logs and telemetry for mt76 driver errors, repeated Wi-Fi association/key failures, memory pressure, OOM events, or unexpected wireless interface resets.
• Treat the issue as normal-priority unless local threat modeling shows exposed wireless attack surface or high availability dependence; current EPSS, KEV, ransomware, and exploit-maturity signals do not indicate active widespread exploitation.