CVE-2026-80936

A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the mlo_pm_work is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to access a deallocated workqueue, resulting in a kernel warning and potentially causing a Denial of Service (DoS) due to system instability.

A flaw of low security impact was found in the Linux kernel's mt76 mt7925 Wi-Fi driver. During multi-link operation (MLO) power-save setup, the driver queues the mlo_pm_work work item with a 5 second delay but never cancels it on the device stop path. If the device is torn down within that window, the pending timer fires after teardown and tries to queue the work onto a workqueue that has already been destroyed, triggering a kernel WARNING and potentially causing a use-after-free and kernel panic, resulting in a local denial of service. Triggering this timing-dependent race requires local access with privileges to stop the Wi-Fi device, and there is no impact on confidentiality or integrity, which is why Red Hat rates the impact of this flaw as Low (Red Hat CVSS 3.1 score 5.5, Moderate). Affected products are Red Hat Enterprise Linux 9 (kernel and kernel-rt in the 9.8, 9.9, and 9.10 streams), Red Hat Enterprise Linux 10 (kernel in the 10.2, 10.3, and 10.4 streams), OpenShift Container Platform 4.22 and later, and Red Hat In-Vehicle OS 2.0 and 2.1, where the fix is currently deferred because the flaw is a low severity, timing-dependent race with availability-only impact; the residual risk is a kernel warning or panic limited to systems using affected mt7925 (MediaTek) Wi-Fi hardware when the device is stopped during multi-link power-save setup. Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2, 9.4, 9.6, and 10.0 streams, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in their kernels. The CVE.org severity for this flaw (7.8, Important) is higher than the Red Hat severity (5.5, Moderate) because the upstream score assumes high confidentiality and integrity impact, whereas Red Hat's analysis found the impact limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.