https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 14:29:25 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80722 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mac80211: validate individual TWT params before driver setup</p> <p>ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it.</p> <p>An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt-&gt;length too short for the full struct ieee80211_twt_params.</p> <p>The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.</p> <p>[edit commit message to not overclaim lack of validation nor understate driver impact]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mac80211: validate individual TWT params before driver setup</p> <p>ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it.</p> <p>An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt-&gt;length too short for the full struct ieee80211_twt_params.</p> <p>The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.</p> <p>[edit commit message to not overclaim lack of validation nor understate driver impact]</p> https://vulnerability.circl.lu/vuln/cve-2026-80722