---
id: CVE-2026-53103
title: 'wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

  roc_abort_sync() can deadlock with roc_work(). roc_work() holds
  dev->mt76.mutex, while cancel_work_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 <
    253cfc33d95ce4a30fd2eca0ff0138603c6c2fcc
  - >-
    Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 <
    153bcba36c87a1ba555b57b6c49028d5812f895b
  - >-
    Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 <
    2d8e0053bca29143ace51e08c980ff076844a4b0
  - >-
    Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 <
    dd08ca3f092f4185ece69ce2a835c23198b1628a
  - Linux 978d1756b3ae1b857826eb7ed8181f3c5180dce9
  - Linux >= 6.11.2 < 6.12
  - Linux 6.12
published: '2026-06-24'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:41:59.799Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53103'
references:
  - url: 'https://git.kernel.org/stable/c/253cfc33d95ce4a30fd2eca0ff0138603c6c2fcc'
  - url: 'https://git.kernel.org/stable/c/153bcba36c87a1ba555b57b6c49028d5812f895b'
  - url: 'https://git.kernel.org/stable/c/2d8e0053bca29143ace51e08c980ff076844a4b0'
  - url: 'https://git.kernel.org/stable/c/dd08ca3f092f4185ece69ce2a835c23198b1628a'
tags:
  - cve.org
epss: 0.00124
epssPercentile: 0.01909
ingestedAt: '2026-10-21T12:48:53.623Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync

roc_abort_sync() can deadlock with roc_work(). roc_work() holds
dev->mt76.mutex, while cancel_work_sync() waits for roc_work()
to finish. If the caller already owns the same mutex, both
sides block and no progress is possible.

This deadlock can occur during station removal when
mt76_sta_state() -> mt76_sta_remove() ->
mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() ->
mt7925_roc_abort_sync() invokes cancel_work_sync() while
roc_work() is still running and holding dev->mt76.mutex.

This avoids the mutex deadlock and preserves exactly-once
work ownership.

## Affected

- `Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 < 253cfc33d95ce4a30fd2eca0ff0138603c6c2fcc`
- `Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 < 153bcba36c87a1ba555b57b6c49028d5812f895b`
- `Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 < 2d8e0053bca29143ace51e08c980ff076844a4b0`
- `Linux >= 45064d19fd3af6aeb0887b35b5564927980cf150 < dd08ca3f092f4185ece69ce2a835c23198b1628a`
- `Linux 978d1756b3ae1b857826eb7ed8181f3c5180dce9`
- `Linux >= 6.11.2 < 6.12`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.