CVE-2026-80825

A flaw was found in the mt7925 Wi-Fi driver in the Linux kernel. A remote attacker could exploit this by sending specially crafted network frames through a bridged interface to an mt7925u Access Point (AP). This improper handling of network packet headroom can lead to a kernel panic, causing a denial of service (DoS) on the affected system.

An skb headroom bug in the mt7925 USB/SDIO transmit path can trigger skb_under_panic when a forwarded bridged frame is transmitted through an mt7925u AP. Locally generated traffic usually has reserved extra_tx_headroom, but frames forwarded through ieee80211_8023_xmit may arrive without enough headroom for the TX descriptor and USB/SDIO header. A network adjacent host on the bridged LAN or Wi-Fi segment can trigger a kernel BUG and crash the system by causing such a frame to be forwarded. For the CVSS the PR:N is used because no local account on the victim is needed when the attacker can send traffic into the affected L2 segment. The attack is not generally Internet reachable and depends on a specific mt7925 USB/SDIO AP bridge setup and ingress driver headroom behavior. Impact is denial of service via kernel crash only, with no supported privilege escalation or information disclosure primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.