Executive brief
The Linux kernel's mt76 WiFi driver for MediaTek MT7925 chips fails to reserve adequate buffer space when forwarding network frames through a WiFi access point. When frames arrive from a wired network connection, the driver attempts to add headers without ensuring sufficient memory is available, causing the kernel to crash and making the WiFi access point unavailable.
Technical details
The vulnerability is a buffer underflow in the mt7925_usb_sdio_tx_prepare_skb() function within the mt76 WiFi driver. The function pushes TX descriptors and USB headers onto network packet buffers (skbs) but does not verify that sufficient headroom exists when forwarding frames from bridge or routing paths. While locally generated traffic reserves the necessary headroom via mac80211's hw->extra_tx_headroom, forwarded frames sent through ieee80211_8023_xmit() do not, causing skb_push() to trigger a kernel panic with "skb_under_panic". The issue affects forwarded frames whose ingress interface provides minimal headroom, particularly on systems like Raspberry Pi 5. The fix, already applied to mt7921, requires adding a headroom check before pushing headers to prevent the underflow condition.
Affected products
- Linux Linux kernel versions containing mt7925 driver prior to fix
Timeline
- 2026-09-04: disclosed