GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80825 (GCVE-0-2026-80825)

Vulnerability from cvelistv5 – Published: 2026-09-04 15:54 – Updated: 2026-09-04 15:54
VLAI
Title
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated traffic, where mac80211 reserves hw->extra_tx_headroom, but forwarded frames are sent through ieee80211_8023_xmit(), which does not reserve it. Bridge a wired interface to an mt7925u AP and the first forwarded frame that arrives short panics the kernel: skbuff: skb_under_panic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1 kernel BUG at net/core/skbuff.c:212! Call trace: skb_panic+0x58/0x60 (P) skb_push+0x58/0x60 mt7925_usb_sdio_tx_prepare_skb+0xf8/0x1b8 [mt7925_common] mt76u_tx_queue_skb+0xa0/0x1f8 [mt76_usb] __mt76_tx_queue_skb+0x54/0xe8 [mt76] mt76_txq_schedule.part.0+0x204/0x478 [mt76] mt76_txq_schedule_all+0x50/0x80 [mt76] mt792x_tx_worker+0x68/0x100 [mt792x_lib] __mt76_worker_fn+0x84/0x150 [mt76] Whether a given setup hits it depends on how much headroom the ingress netdev leaves in its rx skbs. Reproduced on a Raspberry Pi 5 bridging onboard ethernet to a Netgear A9000; originally reported on an MT7986 router running OpenWrt. Nick Morrow's testing on a Pi 4 (bcmgenet), which leaves more headroom, helped narrow the trigger to the ingress path. The same bug was fixed on mt7921 by commit 98c4d0abf5c4 ("mt76: mt7921: don't assume adequate headroom for SDIO headers"), but mt7925 was copied from mt7921 without the fix. Add the same guard here.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 9a72b180f0575e41471e088e09bddc4b73d6dee2 (git)
Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 22edb6786127271aeba7abd30f152977c605c6a3 (git)
Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 8d481f93588932a95f657671d4e1601b90d130cc (git)
Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < e5e8fc11a7ac578f16079f855b7fffc1649d053c (git)
Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < ef3e34874d2332d0f63e72c2c35ce5c93568c125 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.108 , ≤ 6.12.* (semver)
Unaffected: 6.18.49 , ≤ 6.18.* (semver)
Unaffected: 7.1.13 , ≤ 7.1.* (semver)
Unaffected: 7.2.3 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a72b180f0575e41471e088e09bddc4b73d6dee2",
              "status": "affected",
              "version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
              "versionType": "git"
            },
            {
              "lessThan": "22edb6786127271aeba7abd30f152977c605c6a3",
              "status": "affected",
              "version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
              "versionType": "git"
            },
            {
              "lessThan": "8d481f93588932a95f657671d4e1601b90d130cc",
              "status": "affected",
              "version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
              "versionType": "git"
            },
            {
              "lessThan": "e5e8fc11a7ac578f16079f855b7fffc1649d053c",
              "status": "affected",
              "version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
              "versionType": "git"
            },
            {
              "lessThan": "ef3e34874d2332d0f63e72c2c35ce5c93568c125",
              "status": "affected",
              "version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb\n\nmt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB\nheader onto every skb and assumes the headroom for them is already\nthere. That holds for locally generated traffic, where mac80211\nreserves hw-\u003eextra_tx_headroom, but forwarded frames are sent through\nieee80211_8023_xmit(), which does not reserve it. Bridge a wired\ninterface to an mt7925u AP and the first forwarded frame that arrives\nshort panics the kernel:\n\n skbuff: skb_under_panic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1\n kernel BUG at net/core/skbuff.c:212!\n Call trace:\n  skb_panic+0x58/0x60 (P)\n  skb_push+0x58/0x60\n  mt7925_usb_sdio_tx_prepare_skb+0xf8/0x1b8 [mt7925_common]\n  mt76u_tx_queue_skb+0xa0/0x1f8 [mt76_usb]\n  __mt76_tx_queue_skb+0x54/0xe8 [mt76]\n  mt76_txq_schedule.part.0+0x204/0x478 [mt76]\n  mt76_txq_schedule_all+0x50/0x80 [mt76]\n  mt792x_tx_worker+0x68/0x100 [mt792x_lib]\n  __mt76_worker_fn+0x84/0x150 [mt76]\n\nWhether a given setup hits it depends on how much headroom the ingress\nnetdev leaves in its rx skbs. Reproduced on a Raspberry Pi 5 bridging\nonboard ethernet to a Netgear A9000; originally reported on an MT7986\nrouter running OpenWrt. Nick Morrow\u0027s testing on a Pi 4 (bcmgenet),\nwhich leaves more headroom, helped narrow the trigger to the ingress\npath.\n\nThe same bug was fixed on mt7921 by commit 98c4d0abf5c4 (\"mt76:\nmt7921: don\u0027t assume adequate headroom for SDIO headers\"), but mt7925\nwas copied from mt7921 without the fix. Add the same guard here."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:54:29.224Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a72b180f0575e41471e088e09bddc4b73d6dee2"
        },
        {
          "url": "https://git.kernel.org/stable/c/22edb6786127271aeba7abd30f152977c605c6a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d481f93588932a95f657671d4e1601b90d130cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e8fc11a7ac578f16079f855b7fffc1649d053c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef3e34874d2332d0f63e72c2c35ce5c93568c125"
        }
      ],
      "title": "wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80825",
    "datePublished": "2026-09-04T15:54:29.224Z",
    "dateReserved": "2026-08-26T14:34:25.795Z",
    "dateUpdated": "2026-09-04T15:54:29.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80825",
      "date": "2026-09-14",
      "epss": "0.00168",
      "percentile": "0.06394"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80825\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-04T16:18:10.410\",\"lastModified\":\"2026-09-04T16:18:10.410\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb\\n\\nmt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB\\nheader onto every skb and assumes the headroom for them is already\\nthere. That holds for locally generated traffic, where mac80211\\nreserves hw-\u003eextra_tx_headroom, but forwarded frames are sent through\\nieee80211_8023_xmit(), which does not reserve it. Bridge a wired\\ninterface to an mt7925u AP and the first forwarded frame that arrives\\nshort panics the kernel:\\n\\n skbuff: skb_under_panic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1\\n kernel BUG at net/core/skbuff.c:212!\\n Call trace:\\n  skb_panic+0x58/0x60 (P)\\n  skb_push+0x58/0x60\\n  mt7925_usb_sdio_tx_prepare_skb+0xf8/0x1b8 [mt7925_common]\\n  mt76u_tx_queue_skb+0xa0/0x1f8 [mt76_usb]\\n  __mt76_tx_queue_skb+0x54/0xe8 [mt76]\\n  mt76_txq_schedule.part.0+0x204/0x478 [mt76]\\n  mt76_txq_schedule_all+0x50/0x80 [mt76]\\n  mt792x_tx_worker+0x68/0x100 [mt792x_lib]\\n  __mt76_worker_fn+0x84/0x150 [mt76]\\n\\nWhether a given setup hits it depends on how much headroom the ingress\\nnetdev leaves in its rx skbs. Reproduced on a Raspberry Pi 5 bridging\\nonboard ethernet to a Netgear A9000; originally reported on an MT7986\\nrouter running OpenWrt. Nick Morrow\u0027s testing on a Pi 4 (bcmgenet),\\nwhich leaves more headroom, helped narrow the trigger to the ingress\\npath.\\n\\nThe same bug was fixed on mt7921 by commit 98c4d0abf5c4 (\\\"mt76:\\nmt7921: don\u0027t assume adequate headroom for SDIO headers\\\"), but mt7925\\nwas copied from mt7921 without the fix. Add the same guard here.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7925/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c948b5da6bbec742b433138e3e3f9537a85af2e5\",\"lessThan\":\"9a72b180f0575e41471e088e09bddc4b73d6dee2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c948b5da6bbec742b433138e3e3f9537a85af2e5\",\"lessThan\":\"22edb6786127271aeba7abd30f152977c605c6a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c948b5da6bbec742b433138e3e3f9537a85af2e5\",\"lessThan\":\"8d481f93588932a95f657671d4e1601b90d130cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c948b5da6bbec742b433138e3e3f9537a85af2e5\",\"lessThan\":\"e5e8fc11a7ac578f16079f855b7fffc1649d053c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c948b5da6bbec742b433138e3e3f9537a85af2e5\",\"lessThan\":\"ef3e34874d2332d0f63e72c2c35ce5c93568c125\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7925/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.108\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.49\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.13\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.3\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22edb6786127271aeba7abd30f152977c605c6a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8d481f93588932a95f657671d4e1601b90d130cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a72b180f0575e41471e088e09bddc4b73d6dee2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e5e8fc11a7ac578f16079f855b7fffc1649d053c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef3e34874d2332d0f63e72c2c35ce5c93568c125\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-08T17:16:46Z",
      "cve": "CVE-2026-80825",
      "id": "CVE-2026-80825",
      "initial_release_date": "2026-09-08T17:16:46Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "323",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80825",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80825.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.