CVE-2026-80825: Linux Kernel mt76 Buffer Overflow Vulnerability

CVE-2026-80825 Overview

CVE-2026-80825 is a Linux kernel vulnerability in the mt76 Wi-Fi driver stack, specifically in the mt7925 USB/SDIO transmit path. The function mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB header onto every socket buffer (skb) and assumes the required headroom already exists. Locally generated traffic satisfies this assumption because mac80211 reserves hw->extra_tx_headroom, but bridged frames processed by ieee80211_8023_xmit() do not. When an mt7925u device operates as an access point bridged to a wired interface, the first short forwarded frame triggers skb_under_panic and crashes the kernel.

Critical Impact
A remote adjacent attacker on a bridged network segment can trigger a kernel panic on any Linux host using an mt7925u Wi-Fi adapter as an access point, producing a denial-of-service condition.

Affected Products

Linux kernel builds shipping the mt76 driver with mt7925 USB/SDIO support
Systems using MediaTek MT7925 USB Wi-Fi adapters (for example, Netgear A9000) in AP mode
Bridged Wi-Fi configurations on devices such as Raspberry Pi 5 and MT7986-based OpenWrt routers

Discovery Timeline

2026-09-04 - CVE-2026-80825 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80825

Vulnerability Analysis

The defect lives in mt7925_usb_sdio_tx_prepare_skb() inside the mt7925_common kernel module. The function calls skb_push() to prepend a TX descriptor and a USB header to each outbound skb. skb_push() requires sufficient headroom; when the buffer lacks it, the kernel invokes skb_under_panic and halts with a BUG at net/core/skbuff.c:212.

Locally generated Wi-Fi frames enter the driver through mac80211, which reserves hw->extra_tx_headroom on every allocated skb. Bridged frames follow a different path. When a wired interface is bridged to the mt7925u AP, frames traverse ieee80211_8023_xmit(), which does not add the extra headroom. Whether a given deployment panics depends on the headroom the ingress netdev leaves in its receive skbs, which is why the bug manifests on some hardware and not others.

Root Cause

The root cause is a missing headroom guard in the transmit-preparation path — a boundary condition error in kernel buffer handling. The same class of bug was previously fixed on the mt7921 driver in commit 98c4d0abf5c4 ("mt76: mt7921: don't assume adequate headroom for SDIO headers"). The mt7925 driver was copied from mt7921 without carrying the fix forward, leaving the assumption in place.

Attack Vector

Exploitation requires only that an adjacent host send a short Ethernet frame through a bridge into the mt7925u wireless interface. No authentication to the AP is required if the attacker sits on the bridged wired segment. The condition was reproduced on a Raspberry Pi 5 bridging onboard Ethernet (bcmgenet) to a Netgear A9000, and originally reported on an MT7986 OpenWrt router. The observed panic signature is:

skbuff: skb_under_panic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1
kernel BUG at net/core/skbuff.c:212!
Call trace:
  skb_panic+0x58/0x60 (P)
  skb_push+0x58/0x60
  mt7925_usb_sdio_tx_prepare_skb+0xf8/0x1b8 [mt7925_common]
  mt76u_tx_queue_skb+0xa0/0x1f8 [mt76_usb]
  __mt76_tx_queue_skb+0x54/0xe8 [mt76]
  mt76_txq_schedule.part.0+0x204/0x478 [mt76]
  mt76_txq_schedule_all+0x50/0x80 [mt76]
  mt792x_tx_worker+0x68/0x100 [mt792x_lib]
  __mt76_worker_fn+0x84/0x150 [mt76]

Detection Methods for CVE-2026-80825

Indicators of Compromise

Kernel log entries containing skb_under_panic referencing dev:wlan1 or another interface backed by mt7925_common
Call traces including mt7925_usb_sdio_tx_prepare_skb+0xf8/0x1b8 and skb_push+0x58/0x60
Unexpected reboots or oops events on Linux hosts operating an MT7925 USB adapter as an access point bridged to a wired interface

Detection Strategies

Inventory Linux systems that load the mt7925u and mt76_usb modules, then correlate against kernel version to identify unpatched hosts.
Monitor /var/log/kern.log, journalctl -k, and any centralized logging pipeline for skb_under_panic or kernel BUG at net/core/skbuff.c events.
Flag bridge configurations that place an mt7925-driven wireless interface in the same bridge as an Ethernet interface prior to patch deployment.

Monitoring Recommendations

Ship kernel ring buffer contents to a centralized log store and alert on skb_panic, skb_under_panic, and mt7925 stack frames.
Track availability of Wi-Fi AP interfaces; sudden reboot loops on bridged mt7925u devices are consistent with exploitation attempts.
Include the fixing commits 22edb67, 8d481f9, 9a72b18, e5e8fc1, and ef3e348 in patch-compliance queries against build systems and firmware pipelines.

How to Mitigate CVE-2026-80825

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 22edb67, 8d481f9, 9a72b18, e5e8fc1, and ef3e348.
Rebuild OpenWrt and other embedded firmware images that ship the mt76 driver against a fixed kernel before redeploying to routers using MT7925 or MT7986 hardware.
Restrict access to bridged network segments where an unpatched mt7925u AP is exposed until updates are staged.

Patch Information

The fix mirrors the earlier mt7921 correction in commit 98c4d0abf5c4 ("mt76: mt7921: don't assume adequate headroom for SDIO headers"). It adds an explicit headroom check in mt7925_usb_sdio_tx_prepare_skb() and expands the skb headroom via skb_cow_head() when insufficient, preventing the skb_push() underflow. Distribution maintainers are backporting the change through the stable trees referenced in the kernel.org commits above.

Workarounds

Avoid bridging a wired interface directly to an mt7925u AP interface until the kernel patch is applied; use routed forwarding instead.
Replace affected USB adapters with wired connectivity or a non-mt7925 Wi-Fi adapter in production AP deployments where patching is delayed.
Disable AP mode on mt7925u devices where the adapter is only required as a client.

bash

# Verify installed kernel and mt76 module version, then plan an upgrade
uname -r
modinfo mt7925u | grep -E 'filename|version|srcversion'
lsmod | grep -E 'mt7925|mt76'

# Temporary: remove bridged AP configuration until patched
ip link set wlan1 nomaster