CVE-2026-80943 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using the rtlwifi driver, should assess exposure and prioritize patching. They should also review system configurations, monitor system logs, and implement compensating controls for exposed systems. Additionally, they should track and document remediation efforts to ensure thorough vulnerability management.

Why it matters

The Linux kernel vulnerability in the rtlwifi driver requires defenders to verify system exposure, prioritize patching, and monitor for potential exploitation attempts.

• Potential out-of-bounds access leading to system instability
• Possible exploitation attempts require monitoring and logging
• Verification of Linux kernel version and patching is necessary

Technical summary

The rtl92du_tx_fill_desc() function in the Linux kernel's rtlwifi driver does not properly check the QoS TID before indexing into the sta_entry->tids[] array, leading to a potential out-of-bounds access. This issue can cause system instability and potential exploitation attempts. The vulnerability has been resolved by keeping the default RTL_AGG_STOP state for out-of-range TIDs. Defenders should prioritize verifying the Linux kernel version and applying patches to address this vulnerability, particularly for systems using the rtlwifi driver.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and applying patches to address this vulnerability, particularly for systems using the rtlwifi driver.

Recommended defensive actions

• Verify Linux kernel version and apply patches
• Review system configurations for rtlwifi driver usage
• Monitor system logs for potential exploitation attempts
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Review and update incident response plans
• Track and document remediation efforts

Evidence notes

The vulnerability was detected by a static analysis tool and confirmed by manual audit. UBSAN validation reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'. The issue arises from the rtl92du_tx_fill_desc() function not properly checking the QoS TID before indexing into the sta_entry->tids[] array. This can lead to an out-of-bounds access when the QoS TID is greater than 8. The default RTL_AGG_STOP state is kept for out-of-range TIDs, matching rtl92cu_tx_fill_desc().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.