HIGH Introduced in 6.11
rtlwifi TID OOB
CVE-2026-80943
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
KernelScan AI4.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'.
02KernelScan AI Analysis
Risk summary
An attacker within WiFi range can trigger an out-of-bounds array access in the rtl8192du WiFi driver's transmit path. The driver uses an unvalidated QoS TID value as an index into a fixed-size array, reading adjacent driver memory. This can cause incorrect aggregation-state decisions and may destabilize the driver or disrupt connectivity.
Vulnerability analysis
The rtl8192du WiFi driver reads the QoS TID field from an 802.11 header and uses it directly as an array index without checking bounds. The TID field is 4 bits (0-15), but the aggregation state array only has 9 entries (0-8). A QoS frame with TID 9-15 causes an out-of-bounds array access. The fix adds a bounds check so out-of-range TIDs use the default aggregation state instead of indexing past the array. This is reachable by any WiFi-capable attacker within radio range of a device using an affected Realtek rtl8192du chipset.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.11 | 6.12.109 | 6e327f14e1c4 |
| 6.18 | 6.11 | 6.18.50 | 0c0b374e12d5 |
| 7.2 | 6.11 | 7.2.4 | 42785f7e8d31 |
| mainline | 6.11 | 7.3-rc1 | ed4f05d9f2f4 |
| cip/6.12 | 6.11 | 6.12.111-cip32 | 6e327f14e1c4 |