Cloudanix VulnDB

CVE-2026-80722

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux handles certain Wi-Fi setup messages lets nearby attackers crash or potentially take control of wireless devices.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient length validation on received S1G TWT setup frames allows an undersized individual agreement to reach drv_add_twt_setup() and the associated tracepoint, where the full ieee80211_twt_params struct is dereferenced.

Why it matters to the business

Adjacent-network attackers can trigger kernel crashes or memory-safety violations on Linux Wi-Fi devices, causing wireless connectivity loss, system instability, and potential code execution on unpatched hosts.

How an attack unfolds

An attacker on the same Wi-Fi link crafts a TWT action frame whose length field is too small for the full parameters struct, sends it to the target, and the mac80211 receive path forwards the truncated buffer directly to the driver callback without additional bounds checks.

How to fix it

Apply the upstream kernel commit that adds explicit length validation for individual TWT agreements before calling the driver; rebuild and deploy updated kernel packages on all affected systems.

How to confirm the fix worked

Confirm the presence of the length check inside ieee80211_process_rx_twt_action for individual agreements; test with a crafted short TWT frame and verify the frame is dropped before reaching the driver.

Typical attack path

  1. Craft S1G TWT setup frame with twt->length smaller than sizeof(struct ieee80211_twt_params)
  2. Transmit frame over the air to a vulnerable Linux station or AP using mac80211
  3. ieee80211_process_rx_twt_action queues the frame after only partial validation
  4. ieee80211_s1g_rx_twt_setup passes the short buffer to drv_add_twt_setup
  5. Driver or tracepoint reads beyond the supplied buffer, resulting in crash or memory corruption

How to detect it

Search kernel ring buffer and system logs for oops or warnings originating from mac80211 TWT handling; inspect wireless packet captures for TWT action frames whose length field is smaller than the expected parameters struct.

  • ieee80211_s1g_rx_twt_setup
  • drv_add_twt_setup
  • ieee80211_process_rx_twt_action

What your security team should do

  • Prioritize kernel updates on all Linux systems that use mac80211-based Wi-Fi
  • Restrict untrusted Wi-Fi networks until patches are deployed
  • Monitor kernel logs for mac80211 or TWT-related oops or warnings
  • Review downstream device firmware that consumes the same TWT parameters

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type. [edit commit message to not overclaim lack of validation nor understate driver impact]

Affected packages

Ecosystem Package Introduced Fixed