CVE-2026-53102

wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

MEDIUM
5.5
CVSS Score
Published: June 24, 2026 at 04:30 PM UTC
Updated: October 21, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked. Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path. Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change. Compile tested only. Issue found using a prototype static analysis tool and code review.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.18 ≤ v < 7.0.105.186683d988089ce0e80bd859a9493333b6b272420e
Vendor states this is fixed in 7de35b99503012e57bec027e98ed53f881518b5b (fixed)
Vendor states this is fixed in 8527ac1bce87aaabde6755e8e6eb2a9f439d1292 (fixed)
Vendor states this is fixed in c41075ce8cf05ed8c0e7b7efef000dce548ffc42 (fixed)
Vendor states this is fixed in eb466406d2094deefadc2cd6ddb4f6eeb086d1b4 (fixed)
Vendor states this is fixed in 5.18 (unaffected)
Vendor states this is fixed in 6.12.109 (unaffected)
Vendor states this is fixed in 6.18.50 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0.10 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card