AZL-98129
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98129.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-98129
- Upstream
- Published
- 2026-08-28T08:16:58Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-80722 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: validate individual TWT params before driver setup
ieee80211processrxtwtaction() only partially validates a received S1G TWT setup frame before queueing it.
An individual agreement can therefore reach ieee80211s1grxtwtsetup() with twt->length too short for the full struct ieee80211twtparams.
The individual path passes twt to drvaddtwtsetup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely reqtype. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.
[edit commit message to not overclaim lack of validation nor understate driver impact]
- References