CVE-2026-53317 Details
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID over 20 causes a firmware crash. This situation occurred in our testing using an AP interface on 7922 hardware, with a modified hostapd, sourced from Mediatek's OpenWRT feeds. In stock hostapd, station AIDs begin counting at 1, and this configuration is prevented with an upper limit on associated stations. However, the modified hostapd began allocation at 65, which caused the firmware to crash. This fix does not allow these AIDs to work, but will prevent the firmware crash. This crash was only seen on IFTYPE_AP interfaces, and the fix does not appear to have an effect on IFTYPE_STATION behavior.
A vulnerability in the Linux kernel's WiFi MT76 MT7921 driver can lead to a firmware crash when a station is assigned an Association Identifier (AID) greater than 20. This issue was identified on an Access Point (AP) interface using modified hostapd from Mediatek's OpenWRT feeds. The default hostapd configuration prevents this by limiting AID values, but the modified version allocated AIDs starting at 65, triggering the crash. The problem was exclusive to AP interfaces and did not affect Station interfaces.
The vulnerability has been addressed by implementing a hard limit on the maximum AID value, preventing AIDs over 20 from being used. Users should ensure they are running a version of the Linux kernel that includes this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1a4b802afe15c5b33b2dcb37a594aba2fa215d52 | kernel.org | Patch |
| https://git.kernel.org/stable/c/35835ff71e6e618155578b8e3905597edd5f601c | kernel.org | Patch |
| https://git.kernel.org/stable/c/4d0bf21e3e20619d51d06c0c36207aabab8b712c | kernel.org | Patch |
| https://git.kernel.org/stable/c/6dbe70f9ef14d8ac1c24bf19fd9510978a3ab952 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.12, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | kernel.org |