Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80936— wifi: mt76: mt7925: cancel mlo_pm_work on stop

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： wifi: mt76: mt7925: 在停止时取消 mlo_pm_work 在配置多链路（multi-link）省电模式时，mt7925 会以 5 秒的延迟排队执行 ，但在停止（stop）路径中从未取消该工作项。如果设备在该时间窗口内被拆除（teardown），该工作项会在拆除完成后触发，并尝试将自身排入一个已不存在的 workqueue，导致以下警告： mt7921 已经拥有自己的 stop 回调，因此需要为 mt7925 添加一个类似回调，在调用 之前取消该工作项。由

AI Predicted 5.5 Difficulty: Moderate

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 276a568832577c81ec90b62dc506bbdc3781ca46< 304470333b7f525b23699ea7a7aed3b40ca37ca9 affected
276a568832577c81ec90b62dc506bbdc3781ca46< 9e20da749ad229a1aa649ece528721b9652f15e1 affected
276a568832577c81ec90b62dc506bbdc3781ca46< 81faf578320df2dfc682a96baa6e85851dd68b6f affected
74eb79258bfd5f2ffe6d26a09c898992b2afa1ce affected
6.14.3< 6.15 affected
6.15 affected
< 6.15 unaffected
6.18.50≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80936

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: mt76: mt7925: cancel mlo_pm_work on stop
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlo_pm_work on stop mt7925 queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives the teardown and its timer fires afterwards, trying to queue onto the workqueue that is already gone: workqueue: cannot queue mt7925_mlo_pm_work [mt7925_common] on wq phy0 WARNING: kernel/workqueue.c:2283 at __queue_work+0x59/0xa0, CPU#1: swapper/1/0 call_timer_fn+0x2a/0x140 __run_timers+0x203/0x330 run_timer_softirq+0x86/0xf0 mt7921 already has its own stop callback, so add one for mt7925 that cancels the work before calling mt792x_stop(). mt7925_ops backs both the PCIe and USB drivers, so this covers both.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 276a568832577c81ec90b62dc506bbdc3781ca46 ~ 304470333b7f525b23699ea7a7aed3b40ca37ca9 -
Linux Linux 6.15 -

II. Public POCs for CVE-2026-80936

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80936

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80936 (2)

Other References for CVE-2026-80936 (1)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89490 ocfs2: fix readdir position truncation on 32-bit kernels
CVE-2026-89478 sctp: drop a chunk if its transport was removed
CVE-2026-89479 sctp: stop processing a packet once its association is deleted
CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes
CVE-2026-89482 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command
CVE-2026-89483 nvme: zero the discard fallback page
CVE-2026-89484 lockd: fix NULL dereference on lockowner allocation failure
CVE-2026-89485 lockd: pin next file across nlm_inspect_file lock-drop
CVE-2026-89486 ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free
CVE-2026-89489 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
CVE-2026-89491 ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
CVE-2026-89501 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure
CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails
CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks
CVE-2026-89502 ring-buffer: Free cpu_buffer::free_page with subbuf_order

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80936

No comments yet

Leave a comment