PatchSiren cyber security CVE debrief

CVE-2026-53317 Linux CVE debrief

CVE-2026-53317 is a vulnerability in the Linux kernel's wifi mt76 mt7921. The issue arises when a station is configured with an AID (Association ID) over 20, causing a firmware crash. This situation was encountered during testing using an AP interface on 7922 hardware with a modified hostapd. The modified hostapd allocated AIDs starting at 65, leading to the firmware crash. The fix prevents these AIDs from working but will prevent the firmware crash. This crash was only observed on IFTYPE_AP interfaces, and the fix does not appear to affect IFTYPE_STATION behavior.

Vendor: Linux
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-26
Original CVE updated: 2026-07-06
Advisory published: 2026-06-26
Advisory updated: 2026-07-06

Who should care

System administrators and security teams managing Linux-based systems with wifi mt76 mt7921 configurations should be aware of this vulnerability. They should assess their systems for potential exposure and apply necessary patches or mitigations. Additionally, developers working with Linux kernel modules, especially those involving wifi configurations, should consider the implications of this vulnerability.

Technical summary

The vulnerability in the Linux kernel's wifi mt76 mt7921 module occurs when a station's AID exceeds 20, leading to a firmware crash. The mt7921 is a Wi-Fi 6 chipset, and this issue specifically impacts its functionality in AP (Access Point) mode. The problem was identified through testing with modified hostapd configurations that allocated AIDs above the safe threshold. The Linux kernel patch addresses this by imposing an upper limit on station AIDs, preventing the firmware crash but potentially limiting AID configurations.

Defensive priority

Apply the Linux kernel patch that imposes an upper limit on station AIDs for mt76 mt7921 configurations. Review and update wifi configurations to ensure AIDs are within the safe range.

Recommended defensive actions

Apply the Linux kernel patch for CVE-2026-53317.
Review and update wifi configurations to ensure AIDs are within the safe range.
Monitor system logs for firmware crash events related to mt76 mt7921.
Consider updating hostapd configurations to adhere to safe AID allocation practices.
Perform regular security audits of Linux kernel modules and wifi configurations.

Evidence notes

The CVE-2026-53317 vulnerability was identified through testing with a modified hostapd on Linux kernel configurations. The issue specifically affects mt76 mt7921 chipset configurations in AP mode. The Linux kernel patch imposes an upper limit on station AIDs to prevent firmware crashes.

Sources and references

Verified primary and authoritative sources

CVE-2026-53317 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-53317

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-53317 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53317

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/1a4b802afe15c5b33b2dcb37a594aba2fa215d52

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/35835ff71e6e618155578b8e3905597edd5f601c

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/4d0bf21e3e20619d51d06c0c36207aabab8b712c

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/6dbe70f9ef14d8ac1c24bf19fd9510978a3ab952

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.