CVE-2026-53097

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix use-after-free bugs in mt7996macdump_work()

When the mt7996 pci chip is detaching, the mt7996crashdata is released in mt7996coredumpunregister(). However, the work item dumpwork may still be running or pending, leading to UAF bugs when the already freed crashdata is dereferenced again in mt7996macdump_work().

The race condition can occur as follows:

CPU 0 (removal path) | CPU 1 (workqueue) mt7996pciremove() | mt7996sysrecoveryset() mt7996unregisterdevice() | mt7996reset() mt7996coredumpunregister() | queuework() vfree(dev->coredump.crashdata) | mt7996macdumpwork() | crashdata-> // UAF

Fix this by ensuring dumpwork is properly canceled before the crashdata is deallocated. Add cancelworksync() in mt7996unregisterdevice() to synchronize with any pending or executing dump work.