CVE-2026-80943wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'.
- CVSS
- 7.6 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 8321424134a400a5e3eb39f9acca6bc6946ff447 builds before 6e327f14e1c43e175bf530f9165b2cadff308553; 8321424134a400a5e3eb39f9acca6bc6946ff447 builds before 0c0b374e12d52af23ca741728db31091677cf9dc; 8321424134a400a5e3eb39f9acca6bc6946ff447 builds before 42785f7e8d31540e6172bbcf08a7cc3cae1086f8; from 8321424134a400a5e3eb39f9acca6bc6946ff447 before ed4f05d9f2f42fd866f55108db8123eefcc5fb33 | CNA record |
References
- https://git.kernel.org/stable/c/6e327f14e1c43e175bf530f9165b2cadff308553
- https://git.kernel.org/stable/c/0c0b374e12d52af23ca741728db31091677cf9dc
- https://git.kernel.org/stable/c/42785f7e8d31540e6172bbcf08a7cc3cae1086f8
- https://git.kernel.org/stable/c/ed4f05d9f2f42fd866f55108db8123eefcc5fb33
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.