CVE-2026-80934: Linux Kernel mt76 WiFi Driver DoS Vulnerability

CVE-2026-80934 Overview

CVE-2026-80934 is a memory leak vulnerability in the Linux kernel's mt76 wireless driver, specifically affecting the mt7996 and mt7992 chipset support code. The flaw causes a TX DMA (Direct Memory Access) mapping leak whenever the driver transmits an Add Block Acknowledgement (AddBA) request action frame. Each leaked mapping is never returned to the DMA pool, gradually exhausting available resources during normal Wi-Fi client activity.

Critical Impact
On systems with Wireless Ethernet Dispatch (WED) enabled, continuous client reconnect activity exhausts the WED swiotlb pool within one to two days, causing DMA mapping failures for the Wi-Fi microcontroller and other on-SoC consumers.

Affected Products

Linux kernel builds including the mt76 driver with mt7996 support
MediaTek MT7996 Wi-Fi 7 chipset platforms
MediaTek MT7992 Wi-Fi 7 chipset platforms

Discovery Timeline

2026-09-11 - CVE-2026-80934 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80934

Vulnerability Analysis

The mt7996 and mt7992 drivers operate as firmware-TXP (FW-TXP) devices for most transmit paths but hand the firmware a hardware MAC-TXP layout for AddBA request action frames. The driver sets MT_TXD7_MAC_TXD inside mt7996_mac_write_txwi_80211() to signal this exception. On the TX free path, however, the generic helper mt76_connac_txp_skb_unmap() unconditionally decodes the per-frame TXP as a struct mt76_connac_fw_txp, ignoring the MAC-TXP layout used for AddBA frames.

Root Cause

For a MAC-TXP frame, the fw_txp.nbuf byte aliases the AddBA TID word MT_TXP1_TID_ADDBA, which is always zero. The unmap loop therefore iterates zero times and the socket buffer DMA mapping stored in buf[1] is never released. Because buf[1].skip_unmap is set unconditionally by the driver, the generic DMA-ring cleanup path also skips the mapping, leaving one leaked mapping per AddBA request. This is a resource leak stemming from mismatched TX descriptor decoding for two coexisting frame layouts.

Attack Vector

The leak accumulates roughly one DMA mapping per (re)association because each new association triggers an AddBA exchange. On platforms with WED enabled, mappings are routed through the WED software I/O translation buffer (swiotlb) pool. Under sustained client reconnect churn the pool is exhausted within approximately one to two days. After exhaustion, DMA mapping calls fail for WED, the Wi-Fi MCU, and other on-SoC consumers, producing a denial-of-service condition on the wireless subsystem. Triggering the condition does not require authentication because 802.11 association is a prerequisite step for normal client onboarding.

The vulnerability manifests entirely in kernel-side descriptor handling. See the upstream commits (Kernel Git Commit 01f2e0d, Kernel Git Commit b754d3a, Kernel Git Commit deaa2e3) for the applied fix.

Detection Methods for CVE-2026-80934

Indicators of Compromise

Kernel log messages reporting DMA mapping failures originating from the mt76 driver, WED subsystem, or on-SoC MCU consumers.
Steady growth of allocated swiotlb slots on MediaTek MT7996 or MT7992 access point platforms.
Wi-Fi service degradation or MCU errors appearing one to two days after uptime under heavy client churn.

Detection Strategies

Instrument the kernel with tracepoint:dma:dma_map_page and dma_unmap_page and compare counts over time for the wireless device.
Monitor debugfs entries exposed by the mt76 driver for outstanding token counts and TXP consumption trends.
Track kernel dmesg output for warnings such as swiotlb buffer is full or repeated mt7996 MCU command failures.

Monitoring Recommendations

Baseline the normal AddBA request rate per access point and alert on association churn that exceeds the baseline.
Correlate Wi-Fi client reconnect volume with kernel resource metrics to detect gradual exhaustion.
Forward kernel logs from access points and embedded platforms to a centralized analytics tier for long-horizon trend analysis.

How to Mitigate CVE-2026-80934

Immediate Actions Required

Apply the upstream mt76 fix that adds an mt7996-specific TXP unmap routine inspecting MT_TXD7_MAC_TXD and correctly releasing buf[1] for MAC-TXP frames.
Rebuild and deploy affected kernels or vendor firmware images that include the referenced stable commits.
Reboot affected access points to clear any accumulated leaked DMA mappings after patching.

Patch Information

The fix is available in the mainline and stable kernel trees through commits 01f2e0d, b754d3a, and deaa2e3. The patch preserves the deferred token-release unmap that the design relies on and adds an mt7996-specific TXP unmap that delegates to mt76_connac_txp_skb_unmap() for non-MAC-TXP frames.

Workarounds

Disable WED offload on affected MediaTek platforms to remove pressure on the swiotlb pool, accepting a throughput penalty.
Schedule periodic reboots of affected access points until the patched kernel can be deployed.
Reduce association churn by tuning roaming thresholds and client steering to limit the AddBA request rate.

bash

# Verify the running kernel includes the fix by checking the mt76 module version
modinfo mt76 | grep -E '^(version|srcversion|filename):'

# Inspect swiotlb usage on MediaTek SoC access points
dmesg | grep -Ei 'swiotlb|mt7996|mt76'