UBUNTU-CVE-2026-80825: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb() pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated traffic, where mac80211 reserves hw->extratxheadroom, but forwarded frames are sent through ieee802118023xmit(), which does not reserve it. Bridge a wired interface to an mt7925u AP and the first forwarded frame that arrives short panics the kernel: skbuff: skbunderpanic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1 kernel BUG at net/core/skbuff.c:212! Call trace: skbpanic+0x58/0x60 (P) skbpush+0x58/0x60 mt7925usbsdiotxprepareskb+0xf8/0x1b8 [mt7925common] mt76utxqueueskb+0xa0/0x1f8 [mt76usb] mt76txqueueskb+0x54/0xe8 [mt76] mt76txqschedule.part.0+0x204/0x478 [mt76] mt76txqscheduleall+0x50/0x80 [mt76] mt792xtxworker+0x68/0x100 [mt792xlib] mt76workerfn+0x84/0x150 [mt76] Whether a given setup hits it depends on how much headroom the ingress netdev leaves in its rx skbs. Reproduced on a Raspberry Pi 5 bridging onboard ethernet to a Netgear A9000; originally reported on an MT7986 router running OpenWrt. Nick Morrow's testing on a Pi 4 (bcmgenet), which leaves more headroom, helped narrow the trigger to the ingress path. The same bug was fixed on mt7921 by commit 98c4d0abf5c4 ("mt76: mt7921: don't assume adequate headroom for SDIO headers"), but mt7925 was copied from mt7921 without the fix. Add the same guard here.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Systems using an mt7925u wireless adapter as an access point and bridging a wired interface to that AP are exposed to the described failure path. The issue was reproduced when bridging onboard Ethernet to a Netgear A9000 on a Raspberry Pi 5.
What is required to trigger the failure?
A forwarded frame must enter through the bridged wired interface and be transmitted through the affected wireless path without enough skb headroom for the TX descriptor and USB header. Whether this occurs depends on the amount of headroom the ingress network device leaves in received skbs.
How can I tell whether this issue has occurred?
The kernel can panic with an skb_under_panic message followed by a kernel BUG in net/core/skbuff.c, with mt7925_usb_sdio_tx_prepare_skb in the call trace. The trace may also include mt76u_tx_queue_skb, mt76_txq_schedule, and mt792x_tx_worker.