CVE-2026-80936

A bug in the Linux kernel's mt76 Wi-Fi driver for MediaTek MT7925 chipsets schedules a delayed work item (mlo_pm_work, with a 5-second delay) during multi-link power-save setup but never cancels it on the stop path. If the radio is torn down inside that window — for example via interface shutdown, driver unbind, or unplugging a USB adapter — the stale timer fires afterward and tries to queue work onto an already-destroyed workqueue, triggering a kernel WARNING and a use-after-free condition in the workqueue code. The flaw is reachable only locally with low privileges required (CVSS 7.8, local attack vector), and in practice most often manifests as a kernel splat, warning spam, or system instability on Linux systems using MT7925 hardware over PCIe or USB. No public proof-of-concept exists and no exploitation in the wild has been observed.

What to do: Upgrade to a kernel that includes the fix — a stop callback for mt7925 that cancels mlo_pm_work before calling mt792x_stop(), covering both PCIe and USB — via your distribution's routine kernel updates. Until patched, avoid tearing down the MT7925 interface (ifdown, driver unbind, USB unplug, suspend/resume cycles) within roughly 5 seconds of association or power-save setup. Monitor dmesg for the 'cannot queue mt7925_mlo_pm_work' workqueue WARNING as an indicator that the bug has been hit.