---
id: CVE-2026-80938
title: 'wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

  mt7615_suspend() acquired the mt76 mutex and then called
  cancel_delayed_work_sync() on mac_work.  m…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-833
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    36c73b86a09f0e51c0f81a75c8945b6c5557ff27
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    33d29aeb4c0eede92622a7d04ea492b94c30f089
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    ef2ec8b537c3a54e241d693bd03016f80d0d4484
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    3114d479f2a1d31b2e6214c395794c6e5715e579
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    4506e229b2e468b8c64bcf52c50c41a3bf2e633e
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    44be85af3e1772ffb3332feafedad2a73b22854c
  - >-
    Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 <
    bda8324270b1ac91bfba1df8928e0570e29759e8
  - Linux 5.8
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:22.189Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80938'
references:
  - url: 'https://git.kernel.org/stable/c/36c73b86a09f0e51c0f81a75c8945b6c5557ff27'
  - url: 'https://git.kernel.org/stable/c/33d29aeb4c0eede92622a7d04ea492b94c30f089'
  - url: 'https://git.kernel.org/stable/c/ef2ec8b537c3a54e241d693bd03016f80d0d4484'
  - url: 'https://git.kernel.org/stable/c/3114d479f2a1d31b2e6214c395794c6e5715e579'
  - url: 'https://git.kernel.org/stable/c/4506e229b2e468b8c64bcf52c50c41a3bf2e633e'
  - url: 'https://git.kernel.org/stable/c/44be85af3e1772ffb3332feafedad2a73b22854c'
  - url: 'https://git.kernel.org/stable/c/bda8324270b1ac91bfba1df8928e0570e29759e8'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80938.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80938'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532443'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80938'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80938'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80938.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00173
epssPercentile: 0.06639
ingestedAt: '2026-09-14T15:23:07.455Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

mt7615_suspend() acquired the mt76 mutex and then called
cancel_delayed_work_sync() on mac_work.  mt7615_mac_work() acquires the
same mutex via mt7615_mutex_acquire() at the top of the worker, so if
mac_work is already running and blocked on the mutex, the suspend path
deadlocks waiting for the work it holds the mutex against.

Flush scan_work and mac_work before taking the mutex, matching the
suspend paths in mt7921 and mt7925.  scan_work only takes the mt76
spinlock, but moving it keeps the sequence consistent.  This also keeps
mac_work from running over an already suspended HIF, which the previous
split (async cancel under the lock, sync cancel after release) would
have allowed.

## Affected

- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < 36c73b86a09f0e51c0f81a75c8945b6c5557ff27`
- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < 33d29aeb4c0eede92622a7d04ea492b94c30f089`
- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < ef2ec8b537c3a54e241d693bd03016f80d0d4484`
- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < 3114d479f2a1d31b2e6214c395794c6e5715e579`
- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < 4506e229b2e468b8c64bcf52c50c41a3bf2e633e`
- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < 44be85af3e1772ffb3332feafedad2a73b22854c`
- `Linux >= c6bf20109a3fae92402cb76ad709ec5256bcd169 < bda8324270b1ac91bfba1df8928e0570e29759e8`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80938.json)