CVE-2026-80938: Linux Kernel mt76 Race Condition Vulnerability

CVE-2026-80938 Overview

CVE-2026-80938 is a kernel deadlock vulnerability in the Linux mt76 wireless driver, specifically affecting the mt7615 chipset support. The flaw exists in the suspend path, where mt7615_suspend() acquires the mt76 mutex and then calls cancel_delayed_work_sync() on mac_work. Because mt7615_mac_work() acquires the same mutex through mt7615_mutex_acquire() at the top of the worker, a running mac_work blocked on the mutex causes the suspend path to deadlock. The fix flushes scan_work and mac_work before taking the mutex, matching the suspend sequence already used in mt7921 and mt7925.

Critical Impact
Systems using the affected MediaTek MT7615 Wi-Fi driver may hang during suspend when mac_work is executing, resulting in denial of service on the host.

Affected Products

Linux kernel mt76 wireless driver (mt7615 subdriver)
Devices using MediaTek MT7615-family Wi-Fi chipsets
Distributions shipping affected upstream kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-80938 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80938

Vulnerability Analysis

The defect is a classic lock-ordering deadlock inside the Linux kernel wireless stack. The mt7615_suspend() function serializes suspend operations by taking the mt76 mutex early. It then invokes cancel_delayed_work_sync() on the delayed worker mac_work, which waits synchronously for any in-flight execution to complete.

The worker function mt7615_mac_work() itself calls mt7615_mutex_acquire() before it can make progress. If the worker is scheduled and running while suspend is executing, the worker blocks on the mutex held by the suspend thread, and the suspend thread blocks waiting for the worker to finish. Neither side can advance, producing an unrecoverable hang during system suspend.

The upstream resolution reorders the sequence so that scan_work and mac_work are flushed before the mutex is taken. scan_work only uses the mt76 spinlock, but moving it keeps the ordering consistent and matches the proven suspend paths in the mt7921 and mt7925 drivers. The change also prevents mac_work from running against an already-suspended host interface.

Root Cause

The root cause is improper lock acquisition ordering between a suspend context and a delayed workqueue callback that share the same mutex. This is a synchronization defect rather than a memory-safety flaw, closely related to deadlock conditions tracked under CWE-833.

Attack Vector

Exploitation requires local conditions that cause mac_work to be executing at the moment the system enters suspend on hardware bound to the mt7615 driver. The observable impact is a kernel hang and denial of service. No evidence of remote exploitation, code execution, or privilege escalation is associated with this issue, and no public proof of concept is referenced in the advisory data.

Because no verified exploit code is available, refer to the upstream commits listed in the references for the exact source-level change: Kernel Commit 3114d47 and Kernel Commit 44be85a.

Detection Methods for CVE-2026-80938

Indicators of Compromise

Kernel task hung warnings referencing mt7615_suspend, mt7615_mac_work, or cancel_delayed_work_sync in dmesg or journalctl -k output.
Systems using MT7615 Wi-Fi that fail to complete an S3/S4 suspend transition and require a hard reset.
hung_task_timeout_secs messages implicating the mt76 mutex on affected hosts.

Detection Strategies

Inventory endpoints running Linux kernels that predate the fixed commits and enumerate those bound to the mt7615e or mt7615u modules via lsmod and modinfo.
Correlate suspend-failure telemetry with the loaded wireless driver name to isolate hosts exposed to the deadlock.
Monitor kernel logs for INFO: task ... blocked for more than N seconds events referencing wireless workqueue symbols.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM pipeline and alert on repeated hung-task events tied to mt76.
Track patch level of the Linux kernel package across the fleet and flag hosts still on vulnerable versions.
Include suspend/resume health checks in laptop endpoint monitoring for devices using MediaTek Wi-Fi.

How to Mitigate CVE-2026-80938

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream mt76: mt7615 suspend fix as soon as it is available for your distribution.
On unpatched systems, avoid suspend/resume cycles on hosts using MT7615 hardware, or unload the driver before suspend where operationally feasible.
Prioritize patching mobile and laptop fleets, since suspend is exercised routinely on those endpoints.

Patch Information

The fix has been merged upstream and backported through multiple stable trees. Relevant commits include Kernel Commit 3114d47, Kernel Commit 33d29ae, Kernel Commit 36c73b8, Kernel Commit 44be85a, Kernel Commit 4506e22, Kernel Commit bda8324, and Kernel Commit ef2ec8b. Consult your distribution's advisory to determine the exact kernel package version containing the backport.

Workarounds

Unload the mt7615e or mt7615u module with modprobe -r prior to suspend, and reload it after resume.
Disable suspend on affected systems where uptime requirements permit, using systemd mask on the relevant sleep targets.
Switch to an alternate wireless adapter that does not depend on the affected driver until the patched kernel is deployed.

bash

# Verify running kernel and mt76/mt7615 driver status
uname -r
lsmod | grep -E 'mt7615|mt76'

# Temporary mitigation: block the driver from loading on unpatched systems
echo 'blacklist mt7615e' | sudo tee /etc/modprobe.d/blacklist-mt7615.conf
echo 'blacklist mt7615u' | sudo tee -a /etc/modprobe.d/blacklist-mt7615.conf
sudo update-initramfs -u