{"id":"CVE-2026-80943","title":"wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: rtl8192du: check QoS TID before indexing tids\n\nrtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID\nfrom the 802.11 header and then uses i…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 6e327f14e1c43e175bf530f9165b2cadff308553","Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 0c0b374e12d52af23ca741728db31091677cf9dc","Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 42785f7e8d31540e6172bbcf08a7cc3cae1086f8","Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < ed4f05d9f2f42fd866f55108db8123eefcc5fb33","Linux 6.11"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:45:27.392Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80943","references":[{"url":"https://git.kernel.org/stable/c/6e327f14e1c43e175bf530f9165b2cadff308553"},{"url":"https://git.kernel.org/stable/c/0c0b374e12d52af23ca741728db31091677cf9dc"},{"url":"https://git.kernel.org/stable/c/42785f7e8d31540e6172bbcf08a7cc3cae1086f8"},{"url":"https://git.kernel.org/stable/c/ed4f05d9f2f42fd866f55108db8123eefcc5fb33"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80943.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80943"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532256"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80943"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80943"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80943.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00244,"epssPercentile":0.15487,"scores":{"cna":7.6,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.476Z","slug":"CVE-2026-80943","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: rtl8192du: check QoS TID before indexing tids\n\nrtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID\nfrom the 802.11 header and then uses it as an index into\nsta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID\nvalue, so the result can be in the range 0..15.\n\nrtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and\nMAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the\naggregation state array. Keep the default RTL_AGG_STOP state for\nout-of-range TIDs, matching rtl92cu_tx_fill_desc().\n\nThis issue was detected by our static analysis tool and confirmed by\nmanual audit. UBSAN validation for the same bug pattern reports an\narray-index-out-of-bounds access with index 10 for type\n'rtl_tid_data [9]'.\n\n## Affected\n\n- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 6e327f14e1c43e175bf530f9165b2cadff308553`\n- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 0c0b374e12d52af23ca741728db31091677cf9dc`\n- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 42785f7e8d31540e6172bbcf08a7cc3cae1086f8`\n- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < ed4f05d9f2f42fd866f55108db8123eefcc5fb33`\n- `Linux 6.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80943.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224820,"id":"CVE-2026-80943","ts":1792401562349,"field":"cvss","old":"5.5","new":"7.6"},{"seq":224819,"id":"CVE-2026-80943","ts":1792401562349,"field":"severity","old":"medium","new":"high"},{"seq":202745,"id":"CVE-2026-80943","ts":1789403715411,"field":"cvss","old":"7.6","new":"5.5"},{"seq":202744,"id":"CVE-2026-80943","ts":1789403715411,"field":"severity","old":"high","new":"medium"},{"seq":183822,"id":"CVE-2026-80943","ts":1789356677549,"field":"cvss","old":"7.6","new":"5.9"},{"seq":183821,"id":"CVE-2026-80943","ts":1789356677549,"field":"severity","old":"high","new":"medium"},{"seq":153124,"id":"CVE-2026-80943","ts":1789285349125,"field":"cvss","old":null,"new":"7.6"},{"seq":153123,"id":"CVE-2026-80943","ts":1789285349125,"field":"severity","old":"none","new":"high"},{"seq":147570,"id":"CVE-2026-80943","ts":1789270211427,"field":"cvss","old":null,"new":"5.9"},{"seq":147569,"id":"CVE-2026-80943","ts":1789270211427,"field":"severity","old":"none","new":"medium"},{"seq":109328,"id":"CVE-2026-80943","ts":1789183731444,"field":"cvss","old":null,"new":"5.9"},{"seq":109327,"id":"CVE-2026-80943","ts":1789183731444,"field":"severity","old":"none","new":"medium"}]}