CVE-2026-53098 Linux CVE debrief

Who should care

Administrators and users of Linux kernel versions 6.2 through 6.6.141, 6.7 through 6.12.91, 6.13 through 6.18.33, and 6.19 through 7.0.10 should apply patches to mitigate this vulnerability. Additionally, security teams and vulnerability management teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The vulnerability is caused by a race condition between the removal of the mt7915 pci chip and the execution of the dump_work. When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_mac_dump_work(). The issue can be fixed by ensuring dump_work is properly canceled before the crash_data is deallocated.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Inventory and update affected Linux kernel versions
• Monitor system logs for suspicious activity
• Implement compensating controls to detect and prevent exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-06-24T17:17:24.027Z and was last modified on 2026-07-21T18:21:29.883Z. The NVD entry is currently Analyzed. The Linux kernel was found to have a use-after-free vulnerability in the mt7915_mac_dump_work() function. This issue arises when the mt7915 pci chip is detaching, and the mt7915_crash_data is released, but the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again. The vulnerability is caused by a race condition between the removal of the mt7915 pci chip and the execution of the dump_work. When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_mac_dump_work().

Official resources