CVE-2026-80934

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames

(MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise

FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes

the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the

fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is

always zero, so the unmap loop runs zero times and the skb DMA mapping in

buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the

generic DMA-ring cleanup skips it as well.

Each AddBA req therefore leaks one TX DMA mapping, roughly one per

(re)association. With WED enabled these mappings are bounced through the

WED swiotlb pool, so under continuous client reconnect churn the pool is

exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi

MCU and other on-SoC

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References