CVE-2026-80936 Overview
CVE-2026-80936 affects the Linux kernel mt76 wireless driver for MediaTek mt7925 chipsets used in both PCIe and USB variants. The driver queues mlo_pm_work with a five-second delay during multi-link power-save setup but never cancels it during device teardown. If the device stops within that window, the delayed work outlives the teardown and its timer fires against a workqueue that has already been destroyed. The result is a kernel warning at __queue_work+0x59/0xa0 and potential memory corruption when the timer callback references freed resources.
Critical Impact
A local attacker able to trigger rapid interface bring-up and teardown on an affected mt7925 Wi-Fi device can corrupt kernel workqueue state, leading to system instability, denial of service, or local privilege escalation.
Affected Products
- Linux kernel mt76 driver — mt7925 PCIe variant
- Linux kernel mt76 driver — mt7925 USB variant
- Linux kernel stable branches prior to the fix commits 304470333b7f, 81faf578320d, and 9e20da749ad2
Discovery Timeline
- 2026-09-11 - CVE-2026-80936 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-80936
Vulnerability Analysis
The vulnerability lives in the MediaTek mt7925 Wi-Fi driver, which supports multi-link operation (MLO) power-save handling. During MLO power-save setup, the driver schedules mt7925_mlo_pm_work on the per-phy workqueue with a five-second delay. The stop path in mt792x_stop() tears down the interface and destroys the associated workqueue but does not cancel the pending delayed work. When the timer expires after teardown, __queue_work attempts to enqueue the callback onto a workqueue that no longer exists, producing the warning cannot queue mt7925_mlo_pm_work [mt7925_common] on wq phy0 at kernel/workqueue.c:2283.
The underlying condition is a use-after-free of workqueue and driver state driven by an uncancelled timer. Because the mt7921 driver already implements its own stop callback that cancels equivalent work, the fix adds a matching stop callback for mt7925 that invokes cancel_delayed_work_sync() on mlo_pm_work before delegating to mt792x_stop(). The same mt7925_ops structure backs both the PCIe and USB drivers, so the single fix covers both transports.
Root Cause
The root cause is missing lifecycle management for delayed work. The driver schedules mlo_pm_work during power-save setup without a corresponding cancellation in the interface stop path, breaking the invariant that all pending work must be flushed or cancelled before its associated workqueue is destroyed.
Attack Vector
Exploitation requires local access with the ability to control the mt7925 wireless interface. An attacker triggers MLO power-save setup, then rapidly stops the interface within the five-second delay window. Repeated cycles increase the likelihood of the timer firing against freed workqueue state. The vulnerability requires low privileges and no user interaction, but the attack surface is limited to the local host.
See the upstream fix commits for the exact patch:
- git.kernel.org/stable/c/304470333b7f525b23699ea7a7aed3b40ca37ca9
- git.kernel.org/stable/c/81faf578320df2dfc682a96baa6e85851dd68b6f
- git.kernel.org/stable/c/9e20da749ad229a1aa649ece528721b9652f15e1
Detection Methods for CVE-2026-80936
Indicators of Compromise
- Kernel log messages containing cannot queue mt7925_mlo_pm_work [mt7925_common] on wq phy0.
- Kernel warnings at __queue_work+0x59/0xa0 with a call trace including call_timer_fn, __run_timers, and run_timer_softirq.
- Unexpected WARNING entries referencing kernel/workqueue.c:2283 on hosts using mt7925 PCIe or USB Wi-Fi adapters.
Detection Strategies
- Parse dmesg and journalctl -k output for the mt7925_mlo_pm_work warning signature across the fleet.
- Correlate warning timestamps with wireless interface up/down transitions to identify systems exercising the vulnerable code path.
- Inventory endpoints using MediaTek mt7925-based Wi-Fi hardware and cross-reference against installed kernel versions.
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM tier and alert on the mt7925_mlo_pm_work string.
- Track kernel version compliance for mt76 driver updates across Linux endpoints.
- Monitor for repeated wireless interface flapping, which increases the exploitation window.
How to Mitigate CVE-2026-80936
Immediate Actions Required
- Update the Linux kernel to a stable release containing commits 304470333b7f, 81faf578320d, or 9e20da749ad2.
- Prioritize patching endpoints and mobile Linux systems that ship with MediaTek mt7925 PCIe or USB Wi-Fi adapters.
- Restrict local user access on multi-tenant Linux hosts running vulnerable kernels until patches are deployed.
Patch Information
Upstream fixes are available in the mainline and stable trees. See the Kernel Git Commit Fix, the Kernel Git Commit Update, and the Kernel Git Commit Improvement. The patch adds a mt7925-specific stop callback that cancels mlo_pm_work before invoking mt792x_stop(), covering both PCIe and USB drivers backed by mt7925_ops.
Workarounds
- Unload the mt7925e or mt7925u module (modprobe -r mt7925e or modprobe -r mt7925u) on systems that do not require Wi-Fi.
- Disable multi-link operation power-save features in wireless configuration where the driver exposes the option.
- Avoid repeated rapid ip link set wlanX down / up cycles on affected hardware until patched.
# Verify running kernel and mt76 module version
uname -r
modinfo mt7925e | grep -E '^(version|srcversion|filename):'
# Temporarily unload the vulnerable driver
sudo modprobe -r mt7925e # or mt7925u for USB adapters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
