CVE-2026-80825: wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb
mt7925usbsdiotxprepareskb() pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated traffic, where mac80211 reserves hw->extratxheadroom, but forwarded frames are sent through ieee802118023xmit(), which does not reserve it. Bridge a wired interface to an mt7925u AP and the first forwarded frame that arrives short panics the kernel:
skbuff: skbunderpanic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1 kernel BUG at net/core/skbuff.c:212! Call trace: skbpanic+0x58/0x60 (P) skbpush+0x58/0x60 mt7925usbsdiotxprepareskb+0xf8/0x1b8 [mt7925common] mt76utxqueueskb+0xa0/0x1f8 [mt76usb] mt76txqueueskb+0x54/0xe8 [mt76] mt76txqschedule.part.0+0x204/0x478 [mt76] mt76txqscheduleall+0x50/0x80 [mt76] mt792xtxworker+0x68/0x100 [mt792xlib] mt76workerfn+0x84/0x150 [mt76]
Whether a given setup hits it depends on how much headroom the ingress netdev leaves in its rx skbs. Reproduced on a Raspberry Pi 5 bridging onboard ethernet to a Netgear A9000; originally reported on an MT7986 router running OpenWrt. Nick Morrow's testing on a Pi 4 (bcmgenet), which leaves more headroom, helped narrow the trigger to the ingress path.
The same bug was fixed on mt7921 by commit 98c4d0abf5c4 ("mt76: mt7921: don't assume adequate headroom for SDIO headers"), but mt7925 was copied from mt7921 without the fix. Add the same guard here.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mt76 (Linux kernel mt7925/mt792x/mt7921 driver)to a version that resolves this vulnerability.Patch commit 98c4d0abf5c4 - Configuration
On affected systems using the mt7925/mt792x mt76 drivers, apply the kernel fix so mt7925_usb_sdio_tx_prepare_skb reserves adequate TX headroom for SDIO/USB headers and does not assume the headroom for locally generated skbs when forwarding frames.
mt76 (Linux kernel) Ensure TX headroom reserved for forwarded frames in usb_sdio_tx_prepare_skb = apply fix to mt7925_usb_sdio_tx_prepare_skb (reserve hw->extra_tx_headroom for forwarded frames)
Event History
Frequently Asked Questions
Which deployments are most likely to encounter this issue?
Systems using an mt7925-based wireless AP with a wired interface bridged to it are exposed when forwarding traffic from the wired side to Wi-Fi. The issue was reproduced on a Raspberry Pi 5 bridging its onboard Ethernet to a Netgear A9000.
What traffic condition triggers the failure?
A forwarded frame must reach mt7925_usb_sdio_tx_prepare_skb() without enough skb headroom for the TX descriptor and USB header. Locally generated traffic normally has the required headroom reserved by mac80211; forwarded frames sent through ieee80211_8023_xmit() may not.
What is the operational impact and how can it be recognized?
The first undersized forwarded frame can panic the kernel. Logs can show an "skbuff: skb_under_panic" message and a call trace involving skb_push and mt7925_usb_sdio_tx_prepare_skb().
Will every bridged setup trigger the panic?
No. Whether the condition occurs depends on the amount of headroom left in receive skbs by the ingress network device.