CVE-2026-80825: NETGEAR: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb mt7925_usb_sdio_tx_prepare_skb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there
This NETGEAR advisory covers CVE-2026-80825. Related products: NETGEAR.
- CVE-2026-80825
Key facts
- CISA KEV
- Not listed (catalogue checked )
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Related products & platforms
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already
there. That holds for locally generated traffic, where mac80211
reserves hw->extra_tx_headroom, but forwarded frames are sent through ieee80211_8023_xmit(), which does not reserve it.
Bridge a wired interface to an mt7925u AP and the first forwarded frame that arrives
short panics the kernel:
skbuff: skb_under_panic: len:415 put:4 tail:0x19b end:0x640 dev:wlan1 kernel BUG at net/core/skbuff.c:212!
Call trace: skb_panic+0x58/0x60 (P)
skb_push+0x58/0x60 mt7925_usb_sdio_tx_prepare_skb+0xf8/0x1b8 [mt7925_common]
mt76u_tx_queue_skb+0xa0/0x1f8 [mt76_usb] __mt76_tx_queue_skb+0x54/0xe8 [mt76]
mt76_txq_schedule.part.0+0x204/0x478 [mt76] mt76_txq_schedule_all+0x50/0x80 [mt76]
mt792x_tx_worker+0x68/0x100 [mt792x_lib] __mt76_worker_fn+0x84/0x150 [mt76]
Whether a given setup hits it depends on how much headroom the ingress netdev leaves in its rx skbs.
Reproduced on a Raspberry Pi 5 bridging onboard ethernet to a Netgear A9000; originally reported on an MT7986
router running OpenWrt. Nick Morrow's testing on a Pi 4 (bcmgenet),
which leaves more headroom, helped narrow the trigger to the ingress path.
Text from the source record.
More NETGEAR advisories
CVE-2026-0409Jun 9, 2026Orbi: NETGEAR securityCVE-2026-123180Nov 10, 2026RAX30 authentication bypassCVE-2026-123178Nov 10, 2026insufficient input validation vulnerability in the listed NETGEAR Orbi Models routerCVE-2026-107918Oct 13, 2026Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300CVE-2026-107917Oct 13, 2026Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300CVE-2026-11732Oct 13, 2026insufficient input validation vulnerability in the website blocking feature (Block Sites)
Get an email when NETGEAR publishes the next one.
See NETGEAR's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future NETGEAR CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
