CVE-2026-80934

wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

Published Sep 11, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames
(MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise
FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes
the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the
fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is
always zero, so the unmap loop runs zero times and the skb DMA mapping in
buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the
generic DMA-ring cleanup skips it as well.

Each AddBA req therefore leaks one TX DMA mapping, roughly one per
(re)association. With WED enabled these mappings are bounced through the
WED swiotlb pool, so under continuous client reconnect churn the pool is
exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi
MCU and other on-SoC consumers.

Keep the deferred (token release) unmap that the design relies on, and add
an mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps
buf[1] from the MAC-TXP layout for those frames, delegating to
mt76_connac_txp_skb_unmap() otherwise.

Analysis

Technical impact

The Linux kernel’s mt76 driver for Marvell mt7996 and mt7992 Wi‑Fi chipsets has a flaw that leaks a DMA mapping each time an AddBA request frame is processed. Specifically, the weakness is a buffer exhaustion issue (CWE‑771) created because when the frame uses a MAC‑TXP descriptor the cleanup code fails to unmap the associated transmission buffer. The leaked mapping accumulates over repeated association or disassociation events, potentially exhausting the kernel’s WED swiotlb pool and causing subsequent DMA operations to fail, which can disable the WLAN subsystem and other on‑SoC consumers. This bug represents a medium‑severity flaw (CVSS 5.3) that can lead to denial of service for Wi‑Fi operations.

Affected Systems

All Linux kernels that load the mt76 wireless driver and support the Marvell mt7996 or mt7992 chip versions of the driver before the fix referenced in the commit logs; the fix is applied in later kernel releases. Devices running patched kernel or driver versions are no longer affected.

Risk and Exploitability

The CVSS score of medium severity, and the EPSS score of <1% indicates a very low probability of exploitation, though the flaw could be abused if an attacker can induce frequent Wi‑Fi association or disassociation events. The flaw is not immediately exploitable from a remote arbitrary‑code perspective; the attacker would need to deplete the DMA mapping store. Based on the description, it is inferred that the likely attack vector is an entity that can induce the device to perform repeated client reconnects, for example a malicious Wi‑Fi client capable of joining and leaving the network cyclically. While the flaw is not listed in the CISA KEV catalog, it could cause severe service disruption if an attacker can generate the required traffic pattern. Because the condition depends on workload, the risk timeline is continuous exposure rather than a one‑shot vulnerability. Security teams should monitor DMA mapping usage and consider disabling WED or limiting client churn as temporary mitigations until a kernel update is available.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cb6ebbdffef2a888b95f121637cd1fad473919c6`	affected	< 01f2e0da8548f82d704b65b513026cfedc5f8962
`cb6ebbdffef2a888b95f121637cd1fad473919c6`	affected	< b754d3a6d44c53d9853eba374d8a7ef279a9d00a
`cb6ebbdffef2a888b95f121637cd1fad473919c6`	affected	< deaa2e3656937fbbe312f0ee2616c756c6e2511f
`91a5a48702e948e45df01a4f2fd54a0b0d0d6efb`	affected	—
`6.17.8`	affected	< 6.18

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[cb6ebbdffef2a888b95f121637cd1fad473919c6,01f2e0da8548f82d704b65b513026cfedc5f8962)`	affected	code_commit	—
`[cb6ebbdffef2a888b95f121637cd1fad473919c6,b754d3a6d44c53d9853eba374d8a7ef279a9d00a)`	affected	code_commit	—
`[cb6ebbdffef2a888b95f121637cd1fad473919c6,deaa2e3656937fbbe312f0ee2616c756c6e2511f)`	affected	code_commit	—
`91a5a48702e948e45df01a4f2fd54a0b0d0d6efb`	affected	code_commit	—
`[6.17.8,6.18)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.50,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a kernel or mt76 driver version that includes the txp unmapping fix referenced in the described commits.
If an WED subsystem or reduce client reconnection churn while monitoring DMA mapping usage to prevent exhaustion.
For custom kernel builds, recompile the mt76 driver with the fixed unmap logic applied, ensuring the new cleanup path is in use.

Generated by OpenCVE AI on September 21, 2026 at 03:00 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01f2e0da8548f82d704b65b513026cfedc5f8962
https://git.kernel.org/stable/c/b754d3a6d44c53d9853eba374d8a7ef279a9d00a
https://git.kernel.org/stable/c/deaa2e3656937fbbe312f0ee2616c756c6e2511f
https://nvd.nist.gov/vuln/detail/CVE-2026-80934
https://www.cve.org/CVERecord?id=CVE-2026-80934

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-771
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80934 https://www.cve.org/CVERecord?id=CVE-2026-80934
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames (MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is always zero, so the unmap loop runs zero times and the skb DMA mapping in buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the generic DMA-ring cleanup skips it as well. Each AddBA req therefore leaks one TX DMA mapping, roughly one per (re)association. With WED enabled these mappings are bounced through the WED swiotlb pool, so under continuous client reconnect churn the pool is exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi MCU and other on-SoC consumers. Keep the deferred (token release) unmap that the design relies on, and add an mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps buf[1] from the MAC-TXP layout for those frames, delegating to mt76_connac_txp_skb_unmap() otherwise.
Title		wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01f2e0da8548f82d704b65b513026cfedc5f8962 https://git.kernel.org/stable/c/b754d3a6d44c53d9853eba374d8a7ef279a9d00a https://git.kernel.org/stable/c/deaa2e3656937fbbe312f0ee2616c756c6e2511f