HIGH Introduced in 5.15
mac80211 TWTParams OOB
CVE-2026-80722
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.2MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type. [edit commit message to not overclaim lack of validation nor understate driver impact]
02KernelScan AI Analysis
Risk summary
A WiFi access point processing Target Wake Time setup frames can be tricked into reading beyond the received frame data by a crafted frame with an undersized length field. Any WiFi device within range of the access point can trigger this by sending a malformed S1G TWT setup frame. The out-of-bounds read can leak a small amount of kernel memory and pass garbage data to the WiFi driver, potentially causing driver-level issues.
Vulnerability analysis
The WiFi frame processing path for Target Wake Time setup action frames only partially validates the received frame length before queueing it for driver processing. When an access point receives an individual agreement with a length too short to contain the full parameter block, the frame still reaches the driver callback and tracing code, both of which read the complete parameter structure, accessing memory beyond the actual frame data. The fix adds a length check that rejects individual agreements with insufficient length before they are passed to the driver; broadcast agreements are unaffected because they are rejected earlier after accessing only a smaller field. This is reachable by any WiFi device within range that can send a crafted setup frame to an access point operating in AP mode with S1G TWT support; the attacker needs only WiFi proximity and association, not system-level privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.15 | 6.1.183 | 09d60d1f72e6 |
| 6.12 | 5.15 | 6.12.103 | ade9e2f0f7f4 |
| 7.1 | 5.15 | 7.1.8 | 47fb04c3826e |
| mainline | 5.15 | 7.2 | 0502d5077e41 |
| 5.15 | 5.15 | 5.15.216 | 92fcd0f30dc8 |
| 6.18 | 5.15 | 6.18.44 | b558e07708d8 |
| 6.6 | 5.15 | 6.6.151 | ff558072d199 |
| cip/6.1 | 5.15 | 6.1.187-cip60 | 09d60d1f72e6 |
| cip/6.12 | 5.15 | 6.12.104-cip30 | ade9e2f0f7f4 |