CVE-2026-53100

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock occurs in the mt76 wireless driver during remain-on-channel operations. The functions mt76 remain on channel() and mt76 roc complete() call mt76 set channel() while already holding the dev->mutex lock. Because mt76 set channel() also attempts to acquire dev->mutex, a deadlock is triggered. Additionally, a secondary deadlock can occur with the mac work workqueue.

Recommendations Replace calls to mt76 set channel() with mt76 set channel() within the affected functions. Implement cancel delayed work sync() for mac work before acquiring the mutex in mt76 remain on channel() to prevent workqueue deadlocks.