Deadlock Vulnerability in Linux Kernel's MT76 Driver: CVE-2026-80938
Summary
DEBIAN-CVE-2026-80938: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615_suspend() acquired the mt76 mutex and then called cancel_delayed_work_sync()... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for software applications. The MT76 driver is responsible for managing wireless networking hardware, specifically for devices using the MT7615 chipset. This driver is crucial for maintaining stable and efficient wireless connections, but it is susceptible to vulnerabilities that can lead to system instability and security risks.
Vulnerability Detail
CVE-2026-80938 is a deadlock vulnerability in the MT76 driver of the Linux kernel, specifically affecting the MT7615 chipset. The issue arises when the mt7615_suspend() function acquires the mt76 mutex and subsequently calls cancel_delayed_work_sync() on mac_work. If mac_work is already running and blocked on the mutex, the suspend path can deadlock while waiting for the work to release the mutex. This vulnerability can lead to system hangs and degraded performance, particularly in environments relying on wireless connectivity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid the deadlock by ensuring that mac_work and scan_work are flushed before acquiring the mt76 mutex. This can be done by modifying the driver code, but it is recommended to apply the official patch instead.
Conclusion
CVE-2026-80938 presents a significant deadlock vulnerability in the Linux kernel's MT76 driver, affecting wireless connectivity. Users are advised to update their systems to the latest kernel version to mitigate this risk. For those unable to update immediately, a temporary workaround is available, but applying the official patch is the best long-term solution.
See every vulnerability recorded for linux →
FAQ
CVE-2026-80938 is a vulnerability in the Linux kernel's MT76 driver that can cause system deadlocks under certain conditions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to system hangs and degraded performance, particularly in wireless networking scenarios.
Yes, a patch has been released in newer versions of the Linux kernel. Users should update their kernel to the latest version to mitigate the risk.
If an immediate update is not possible, consider implementing the suggested workaround to avoid deadlocks until a proper fix can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
