---
id: CVE-2026-80943
title: 'wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

  rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID
  from the 802.11 header and then uses i…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 <
    6e327f14e1c43e175bf530f9165b2cadff308553
  - >-
    Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 <
    0c0b374e12d52af23ca741728db31091677cf9dc
  - >-
    Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 <
    42785f7e8d31540e6172bbcf08a7cc3cae1086f8
  - >-
    Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 <
    ed4f05d9f2f42fd866f55108db8123eefcc5fb33
  - Linux 6.11
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:27.392Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80943'
references:
  - url: 'https://git.kernel.org/stable/c/6e327f14e1c43e175bf530f9165b2cadff308553'
  - url: 'https://git.kernel.org/stable/c/0c0b374e12d52af23ca741728db31091677cf9dc'
  - url: 'https://git.kernel.org/stable/c/42785f7e8d31540e6172bbcf08a7cc3cae1086f8'
  - url: 'https://git.kernel.org/stable/c/ed4f05d9f2f42fd866f55108db8123eefcc5fb33'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80943.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80943'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532256'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80943'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80943'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80943.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00244
epssPercentile: 0.15487
scores:
  cna: 7.6
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID
from the 802.11 header and then uses it as an index into
sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID
value, so the result can be in the range 0..15.

rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and
MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the
aggregation state array. Keep the default RTL_AGG_STOP state for
out-of-range TIDs, matching rtl92cu_tx_fill_desc().

This issue was detected by our static analysis tool and confirmed by
manual audit. UBSAN validation for the same bug pattern reports an
array-index-out-of-bounds access with index 10 for type
'rtl_tid_data [9]'.

## Affected

- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 6e327f14e1c43e175bf530f9165b2cadff308553`
- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 0c0b374e12d52af23ca741728db31091677cf9dc`
- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < 42785f7e8d31540e6172bbcf08a7cc3cae1086f8`
- `Linux >= 8321424134a400a5e3eb39f9acca6bc6946ff447 < ed4f05d9f2f42fd866f55108db8123eefcc5fb33`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80943.json)