Bug 2492383 (CVE-2026-53104)

Summary:	CVE-2026-53104 kernel: wifi: mt76: Fix memory leak destroying device
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability, a memory leak, occurs when the device is destroyed during module unload. Specifically, the `mt76_dma_cleanup` routine fails to properly destroy the `page_pool` associated with all MT76 receive queues, leading to unreleased memory. Over time, this can lead to system instability or a denial of service (DoS) due to resource exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-24 18:09:05 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix memory leak destroying device

All MT76 rx queues have an associated page_pool even if the queue is not
associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the
page_pool running mt76_dma_cleanup routine during module unload.
Moreover returns pages to the page pool if WED is not enabled for WED RRO
queues.

Comment 1 Mauro Matteo Cascella 2026-06-26 15:48:52 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062412-CVE-2026-53104-95e8@gregkh/T