Answer in brief
CVE-2026-80943 records a High severity (CVSS 7.6) vulnerability in wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8321424134a400a5e3eb39f9acca6bc6946ff447 <6e327f14e1c43e175bf530f9165b2cadff308553 || >=8321424134a400a5e3eb39f9acca6bc6946ff447 <0c0b374e12d52af23ca741728db31091677cf9dc || >=8321424134a400a5e3eb39f9acca6bc6946ff447 <42785f7e8d31540e6172bbcf08a7cc3cae1086f8 || >=8321424134a400a5e3eb39f9acca6bc6946ff447 <ed4f05d9f2f42fd866f55108db8123eefcc5fb33 | 6e327f14e1c43e175bf530f9165b2cadff308553, 0c0b374e12d52af23ca741728db31091677cf9dc, 42785f7e8d31540e6172bbcf08a7cc3cae1086f8, ed4f05d9f2f42fd866f55108db8123eefcc5fb33 |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'.
Quoted source text, attributed separately from HOL analysis.