CVE-2026-80936 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of systems that utilize the mt76 driver, should assess their exposure and verify that the patch has been applied. The vulnerability could lead to system crashes or errors if exploited, and it is essential to review and apply the patch to prevent potential issues. The affected operator, platform, vulnerability-management, and security-team impact should be considered when implementing the patch.

Why it matters

A use-after-free vulnerability in the Linux kernel's mt76 driver requires patch application and verification to prevent potential system crashes or errors.

• Potential system crashes or errors due to use-after-free vulnerability
• Need to verify patch application to prevent potential issues
• Requires monitoring of system logs for related errors

Technical summary

The Linux kernel's mt76 driver, specifically the mt7925 module, has a use-after-free vulnerability. The mlo_pm_work workqueue is not canceled on the stop path, leading to a potential crash when the device is torn down. This issue has been resolved by adding a stop callback for mt7925 that cancels the work before calling mt792x_stop(). The vulnerability could lead to system crashes or errors if exploited. It is essential to review and apply the patch to prevent potential issues. The affected product context and defensive impact should be considered when implementing the patch.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to ensure the mt7925 stop callback is properly canceling the mlo_pm_work workqueue.
• Verify that the mt7925 module is properly configured and updated.
• Monitor system logs for potential crashes or errors related to the mt76 driver.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source references provide information about the vulnerability and its resolution. However, there is limited information about the impact and affected systems. Further verification is required to determine the extent of the vulnerability and to ensure that the patch has been applied. The affected product deployments should be identified, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.