wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked. Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path. Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change. Compile tested only. Issue found using a prototype static analysis tool and code review.
CVE-2026-53102
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53102
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6683d988089ce0e80bd859a9493333b6b272420e",
"lessThan": "a2af91af9536922edc3f63de90c3f1fe9db71717",
"versionType": "git"
},
{
"status": "affected",
"version": "6683d988089ce0e80bd859a9493333b6b272420e",
"lessThan": "7de35b99503012e57bec027e98ed53f881518b5b",
"versionType": "git"
},
{
"status": "affected",
"version": "6683d988089ce0e80bd859a9493333b6b272420e",
"lessThan": "8527ac1bce87aaabde6755e8e6eb2a9f439d1292",
"versionType": "git"
},
{
"status": "affected",
"version": "6683d988089ce0e80bd859a9493333b6b272420e",
"lessThan": "eb466406d2094deefadc2cd6ddb4f6eeb086d1b4",
"versionType": "git"
},
{
"status": "affected",
"version": "6683d988089ce0e80bd859a9493333b6b272420e",
"lessThan": "c41075ce8cf05ed8c0e7b7efef000dce548ffc42",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c",
"drivers/net/wireless/mediatek/mt76/mt7915/mcu.c",
"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c",
"drivers/net/wireless/mediatek/mt76/mt7915/mcu.c",
"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53102
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46362 · Revision 1
- Added to Heist Feed
- Publisher date