CVE-2026-80722

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80722
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80722.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80722
Downstream
Published
2026-08-28T06:53:17.886Z
Modified
2026-08-31T03:30:34.360841241Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
wifi: mac80211: validate individual TWT params before driver setup
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: validate individual TWT params before driver setup

ieee80211processrxtwtaction() only partially validates a received S1G TWT setup frame before queueing it.

An individual agreement can therefore reach ieee80211s1grxtwtsetup() with twt->length too short for the full struct ieee80211twtparams.

The individual path passes twt to drvaddtwtsetup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely reqtype. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.

[edit commit message to not overclaim lack of validation nor understate driver impact]

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80722.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f5a4c24e689f54e66201f04d343bdd2e8a1d7923
Fixed
92fcd0f30dc8e51f252589b082d46851d295cc1a
Fixed
09d60d1f72e6598241490eb6c4e97245af895c09
Fixed
ff558072d199c1d641d1561da622e67f780514de
Fixed
ade9e2f0f7f4d3089600ac2af8ef0b91746f923b
Fixed
b558e07708d886acfcf4b0391ed7a8546e81d326
Fixed
47fb04c3826e1f90271d405523043d6708b9072a
Fixed
0502d5077e419427d80f4d46ba95d0067f5fb916

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80722.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
5.15.216
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.183
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.151
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.103
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.44
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80722.json"