Answer in brief
CVE-2026-80944 records a High severity (CVSS 7.8) vulnerability in wifi: mwifiex: Detach sync cmd buffer on interrupted wait. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3d026d09b28dda24777129a931634949c75a9181 <20ee9c03f261bf6ac59331e2ca7b46b23646412a || >=3d026d09b28dda24777129a931634949c75a9181 <b1bbeb8970eeb6c6bf3cd5314138103f7b69446d || >=3d026d09b28dda24777129a931634949c75a9181 <d29a165588b6a0cf7a38db5cbd602aef7ef8c658 || >=3d026d09b28dda24777129a931634949c75a9181 <ef06882c7d8a7400b67d0d003b1008093dd589ed | 20ee9c03f261bf6ac59331e2ca7b46b23646412a, b1bbeb8970eeb6c6bf3cd5314138103f7b69446d, d29a165588b6a0cf7a38db5cbd602aef7ef8c658, ef06882c7d8a7400b67d0d003b1008093dd589ed |
| Linux/Linuxgeneric | 3.15 | Not reported |
| Linux/Linuxgeneric | >=3d026d09b28dda24777129a931634949c75a9181 <8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9 || >=3d026d09b28dda24777129a931634949c75a9181 <9024c7729eb523cf4f3a4203966d3a4aaabf030d || >=3d026d09b28dda24777129a931634949c75a9181 <9e06c9c8a1f10c55d9bc5d139656d58795e64483 || >=3d026d09b28dda24777129a931634949c75a9181 <f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3 || >=3d026d09b28dda24777129a931634949c75a9181 <20ee9c03f261bf6ac59331e2ca7b46b23646412a || >=3d026d09b28dda24777129a931634949c75a9181 <b1bbeb8970eeb6c6bf3cd5314138103f7b69446d || >=3d026d09b28dda24777129a931634949c75a9181 <d29a165588b6a0cf7a38db5cbd602aef7ef8c658 || >=3d026d09b28dda24777129a931634949c75a9181 <ef06882c7d8a7400b67d0d003b1008093dd589ed | 8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9, 9024c7729eb523cf4f3a4203966d3a4aaabf030d, 9e06c9c8a1f10c55d9bc5d139656d58795e64483, f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3, 20ee9c03f261bf6ac59331e2ca7b46b23646412a, b1bbeb8970eeb6c6bf3cd5314138103f7b69446d, d29a165588b6a0cf7a38db5cbd602aef7ef8c658, ef06882c7d8a7400b67d0d003b1008093dd589ed |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997.
Quoted source text, attributed separately from HOL analysis.