{"id":"CVE-2026-80934","revision":null,"records":[{"revision":"843f3e3867004bada385edcc8bb4935b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80934","aliases":[],"title":"wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames\n\nmt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames\n(MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise\nFW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes\nthe per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the\nfw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is\nalways zero, so the unmap loop runs zero times and the skb DMA mapping in\nbuf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the\ngeneric DMA-ring cleanup skips it as well.\n\nEach AddBA req therefore leaks one TX DMA mapping, roughly one per\n(re)association. With WED enabled these mappings are bounced through the\nWED swiotlb pool, so under continuous client reconnect churn the pool is\nexhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi\nMCU and other on-SoC consumers.\n\nKeep the deferred (token release) unmap that the design relies on, and add\nan mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps\nbuf[1] from the MAC-TXP layout for those frames, delegating to\nmt76_connac_txp_skb_unmap() otherwise.","state":0,"publishedAt":"2026-09-11T19:42:08.494+00:00","modifiedAt":"2026-10-19T08:45:18.03+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cb6ebbdffef2a888b95f121637cd1fad473919c6\",\n                            \"lessThan\": \"01f2e0da8548f82d704b65b513026cfedc5f8962\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cb6ebbdffef2a888b95f121637cd1fad473919c6\",\n                            \"lessThan\": \"b754d3a6d44c53d9853eba374d8a7ef279a9d00a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cb6ebbdffef2a888b95f121637cd1fad473919c6\",\n                            \"lessThan\": \"deaa2e3656937fbbe312f0ee2616c756c6e2511f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91a5a48702e948e45df01a4f2fd54a0b0d0d6efb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.17.8\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/01f2e0da8548f82d704b65b513026cfedc5f8962","https://git.kernel.org/stable/c/b754d3a6d44c53d9853eba374d8a7ef279a9d00a","https://git.kernel.org/stable/c/deaa2e3656937fbbe312f0ee2616c756c6e2511f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80934","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80934","identifiers":["CVE-2026-80934"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T05:02:23.3236319+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T05:02:23.3236319+00:00","lastSuccessAt":"2026-11-09T05:02:23.479545+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:23.4795489+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-61bf15172f364246efc204ad9b25e3f89710939e13c23b3efb3d009b5fdad808","complete":true,"records":421290,"lastAttemptAt":"2026-11-09T05:02:14.5383867+00:00","lastSuccessAt":"2026-11-09T05:02:14.5253969+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:14.5383867+00:00","snapshotPublishedAt":"2026-11-09T04:29:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4f2cebce00d8473081b28b769c5ae383","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T05:14:17.7698071+00:00","lastSuccessAt":"2026-11-09T05:14:17.765+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T05:14:17.765+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13657,"expectedIdentifiers":13706,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T05:02:23.3236319+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T05:02:23.3236319+00:00","lastSuccessAt":"2026-11-09T05:02:23.4802497+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:23.4802499+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5a44a451442747cb81d83104fe1e7771","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T05:02:23.9456768+00:00","lastSuccessAt":"2026-11-09T02:08:52.274+00:00","error":null,"lastVerifiedAt":"2026-11-09T02:08:52.274+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T05:02:15.1760519+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:15.1760519+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T05:02:14.6871775+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:14.6871775+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T05:02:23.2913664+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:23.2913664+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-6a1c845b1938b1aa788f0e95c9ac8a8d5a1f07caed5d155840b0616b548c1455","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T05:02:15.0730779+00:00","lastSuccessAt":"2026-11-09T04:03:49.859595+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:15.0730779+00:00","snapshotPublishedAt":"2026-11-09T03:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}