Look up another CVE · open CVE-2026-80722 in the interactive tracker
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver setup
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem net/mac80211. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80722 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type. [edit commit message to not overclaim lack of validation nor understate driver impact]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/mac80211/s1g.c
- What this is
- MAC80211MAINTAINERS section matched on net/mac80211/ · linux-wireless@vger.kernel.org · Maintained
- Kernel module
- mac80211
Check it on the machine
grep -w CONFIG_MAC80211 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w mac80211Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_MAC80211
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.24%, higher than 13.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/mac80211
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 5.15.216 | 92fcd0f30dc8 |
| 5.15 | 6.1.183 | 09d60d1f72e6 |
| 5.15 | 6.6.151 | ff558072d199 |
| 5.15 | 6.12.103 | ade9e2f0f7f4 |
| 5.15 | 6.18.44 | b558e07708d8 |
| 5.15 | 7.1.8 | 47fb04c3826e |
| 5.15 | 7.2 | 0502d5077e41 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.
- AC:LAttack complexity, low
- The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.
- PR:NPrivileges required, none
- No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).
- UI:NUser interaction, none
- No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.
- S:UScope, unchanged
- Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).
- C:HConfidentiality impact, high
- drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.
- I:HIntegrity impact, high
- MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.
- A:HAvailability impact, high
- Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames.