CVE-2026-80943
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'.
How to fix
- Linux Linux6e327f14e1c43e175bf530f9165b2cadff308553, 0c0b374e12d52af23ca741728db31091677cf9dc, 42785f7e8d31540e6172bbcf08a7cc3cae1086f8, ed4f05d9f2f42fd866f55108db8123eefcc5fb33 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 8321424134a400a5e3eb39f9acca6bc6946ff447 ≤ v < 6e327f14e1c43e175bf530f9165b2cadff308553, 8321424134a400a5e3eb39f9acca6bc6946ff447 ≤ v < 0c0b374e12d52af23ca741728db31091677cf9dc, 8321424134a400a5e3eb39f9acca6bc6946ff447 ≤ v < 42785f7e8d31540e6172bbcf08a7cc3cae1086f8, 8321424134a400a5e3eb39f9acca6bc6946ff447 ≤ v < ed4f05d9f2f42fd866f55108db8123eefcc5fb33, 6.11 | 6e327f14e1c43e175bf530f9165b2cadff308553, 0c0b374e12d52af23ca741728db31091677cf9dc, 42785f7e8d31540e6172bbcf08a7cc3cae1086f8, ed4f05d9f2f42fd866f55108db8123eefcc5fb33 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.