---
id: CVE-2026-53100
title: 'wifi: mt76: fix deadlock in remain-on-channel'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: fix deadlock in remain-on-channel

  mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel()
  while already holding dev->mutex. Since mt76_set…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f <
    5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd
  - >-
    Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f <
    7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f
  - >-
    Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f <
    6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e
  - Linux 6.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:18:21.506578Z'
published: '2026-06-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:23:59.367Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53100'
references:
  - url: 'https://git.kernel.org/stable/c/5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd'
  - url: 'https://git.kernel.org/stable/c/7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f'
  - url: 'https://git.kernel.org/stable/c/6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e'
tags:
  - cve.org
epss: 0.00124
epssPercentile: 0.02119
ingestedAt: '2026-11-06T16:57:43.293Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: fix deadlock in remain-on-channel

mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel()
while already holding dev->mutex. Since mt76_set_channel() also acquires
dev->mutex, this results in a deadlock.

Use __mt76_set_channel() instead of mt76_set_channel().
Add cancel_delayed_work_sync() for mac_work before acquiring the mutex
in mt76_remain_on_channel() to prevent a secondary deadlock with the
mac_work workqueue.

## Affected

- `Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 5fc8c5d45e44575dda9fcabdc2aac4ad97baf0cd`
- `Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 7a89c245d203aa0ed5ff2d68ac05b48b2ef9fa3f`
- `Linux >= a8f424c1287cc79a06c21816658feea87dfcb83f < 6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.