Executive brief
The Linux kernel's WiFi MAC layer (mac80211) fails to fully validate individual Target Wake Time (TWT) parameters before passing them to device drivers. An attacker who can inject or manipulate specially crafted TWT frames could trigger out-of-bounds memory access in the driver, potentially causing a kernel crash or enabling code execution on affected systems.
Technical details
The vulnerability exists in ieee80211_process_rx_twt_action() and ieee80211_s1g_rx_twt_setup() functions in net/mac80211/s1g.c. The code only partially validates received S1G TWT setup frames before passing them to the driver via drv_add_twt_setup(). Specifically, for individual (non-broadcast) agreements, the twt->length field is not validated to ensure it contains the full ieee80211_twt_params structure. When a malformed frame reaches drv_add_twt_setup(), both the kernel tracepoint and driver callback consume the complete parameters block, triggering out-of-bounds memory access. The attack requires network-adjacent position to inject 802.11 management frames. A fix validates the length field before driver callback for individual agreements only, rejecting undersized frames.
Affected products
- Linux Linux kernel multiple versions (affected by individual TWT support introduced in commit f5a4c24e689f)
Timeline
- 2026-08-28: disclosed: CVE-2026-80722 published
- 2026-07-28: patched: Fix committed upstream (0502d5077e419427d80f4d46ba95d0067f5fb916)
- 2026-08-19: patched: Fix backported to stable kernels (09d60d1f72e6598241490eb6c4e97245af895c09)