CVE-2026-80934

Received Received - Intake

WiFi: mt76 mt7996 TX DMA Mapping Leak in AddBA Request Frames

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames (MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is always zero, so the unmap loop runs zero times and the skb DMA mapping in buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the generic DMA-ring cleanup skips it as well. Each AddBA req therefore leaks one TX DMA mapping, roughly one per (re)association. With WED enabled these mappings are bounced through the WED swiotlb pool, so under continuous client reconnect churn the pool is exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi MCU and other on-SoC consumers. Keep the deferred (token release) unmap that the design relies on, and add an mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps buf[1] from the MAC-TXP layout for those frames, delegating to mt76_connac_txp_skb_unmap() otherwise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-80934

EUVD

EUVD-2026-76257

Affected Vendors & Products

Vendor	Product	Version / Range
mt76	mt7996	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the mt76 WiFi driver affecting mt7996 and mt7992 chipsets. It causes a TX DMA mapping leak when handling AddBA request frames during WiFi associations. The firmware incorrectly processes these frames, leading to unmapped DMA buffers. This can exhaust the DMA mapping pool under continuous client reconnections.

Detection Guidance

This vulnerability is specific to the Linux kernel's mt76 driver for MediaTek MT7996/MT7992 WiFi chips. Detection requires checking kernel logs for DMA mapping failures or WiFi disconnections. Monitor for 'DMA mapping failed' errors in dmesg or syslog. If WED is enabled, watch for 'swiotlb buffer exhausted' messages. No direct commands detect this, but kernel logs and WiFi driver errors may indicate the issue.

Impact Analysis

If you use affected devices with frequent WiFi reconnections, the DMA mapping pool may exhaust after 1-2 days. This causes DMA mapping failures for WiFi and other system components, leading to WiFi disconnections or system instability. Systems with WED enabled are particularly vulnerable.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a specific technical issue in the Linux kernel's WiFi driver (mt76) related to DMA mapping leaks in AddBA request frames. Compliance implications would depend on how the affected system is used and whether it processes or transmits regulated data.

Mitigation Strategies

Apply the Linux kernel patch that fixes the TX DMA mapping leak in the mt76 driver. Update to a kernel version containing the fix (e.g., 6.6.12 or later). If immediate patching is not possible, disable WED (WiFi offload engine) to prevent DMA mapping exhaustion. Monitor WiFi stability and DMA errors as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-80934. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70