The Linux kernel mt76 wifi driver for mt7996/mt7992 chipsets improperly handles TX DMA mappings for AddBA request frames. Specifically, the firmware hands a HW MAC-TXP for these frames, but the unmap function decodes the frame as a FW-TXP device, causing the DMA mapping in buf[1] to never be unmapped. This results in a leak of one TX DMA mapping per AddBA request, which accumulates during client reconnect churn. With WED enabled, these leaked mappings consume the swiotlb pool, leading to exhaustion after approximately 1-2 days and causing DMA mapping failures for WED, the WiFi MCU, and other on-SoC consumers. The fix involves adding an mt7996-specific unmap routine that correctly handles the MAC-TXP layout for these frames while maintaining the deferred unmap mechanism.

The vulnerability causes a resource leak of TX DMA mappings during AddBA request frames, which can exhaust the swiotlb pool under continuous client reconnect churn. This exhaustion leads to DMA mapping failures affecting WED, the WiFi MCU, and other on-SoC components, potentially degrading or disrupting WiFi and related system functionality over time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding an mt7996-specific unmap routine to properly release DMA mappings for affected frames. Until an official patch is confirmed, monitoring for updates from the Linux kernel maintainers or the mt76 driver developers is recommended.