---
id: CVE-2026-80934
title: 'wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

  mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames
  (MT_TXD7_MAC_TXD, set in mt79…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-771
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cb6ebbdffef2a888b95f121637cd1fad473919c6 <
    01f2e0da8548f82d704b65b513026cfedc5f8962
  - >-
    Linux >= cb6ebbdffef2a888b95f121637cd1fad473919c6 <
    b754d3a6d44c53d9853eba374d8a7ef279a9d00a
  - >-
    Linux >= cb6ebbdffef2a888b95f121637cd1fad473919c6 <
    deaa2e3656937fbbe312f0ee2616c756c6e2511f
  - Linux 91a5a48702e948e45df01a4f2fd54a0b0d0d6efb
  - Linux >= 6.17.8 < 6.18
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:18.030Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80934'
references:
  - url: 'https://git.kernel.org/stable/c/01f2e0da8548f82d704b65b513026cfedc5f8962'
  - url: 'https://git.kernel.org/stable/c/b754d3a6d44c53d9853eba374d8a7ef279a9d00a'
  - url: 'https://git.kernel.org/stable/c/deaa2e3656937fbbe312f0ee2616c756c6e2511f'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80934.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80934'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532169'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80934'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80934'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80934.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.1061
ingestedAt: '2026-09-14T00:35:28.532Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames
(MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise
FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes
the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the
fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is
always zero, so the unmap loop runs zero times and the skb DMA mapping in
buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the
generic DMA-ring cleanup skips it as well.

Each AddBA req therefore leaks one TX DMA mapping, roughly one per
(re)association. With WED enabled these mappings are bounced through the
WED swiotlb pool, so under continuous client reconnect churn the pool is
exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi
MCU and other on-SoC consumers.

Keep the deferred (token release) unmap that the design relies on, and add
an mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps
buf[1] from the MAC-TXP layout for those frames, delegating to
mt76_connac_txp_skb_unmap() otherwise.

## Affected

- `Linux >= cb6ebbdffef2a888b95f121637cd1fad473919c6 < 01f2e0da8548f82d704b65b513026cfedc5f8962`
- `Linux >= cb6ebbdffef2a888b95f121637cd1fad473919c6 < b754d3a6d44c53d9853eba374d8a7ef279a9d00a`
- `Linux >= cb6ebbdffef2a888b95f121637cd1fad473919c6 < deaa2e3656937fbbe312f0ee2616c756c6e2511f`
- `Linux 91a5a48702e948e45df01a4f2fd54a0b0d0d6efb`
- `Linux >= 6.17.8 < 6.18`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80934.json)