GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80944 (GCVE-0-2026-80944)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3d026d09b28dda24777129a931634949c75a9181 , < 8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9 (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < 9024c7729eb523cf4f3a4203966d3a4aaabf030d (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < 9e06c9c8a1f10c55d9bc5d139656d58795e64483 (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3 (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < 20ee9c03f261bf6ac59331e2ca7b46b23646412a (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < b1bbeb8970eeb6c6bf3cd5314138103f7b69446d (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < d29a165588b6a0cf7a38db5cbd602aef7ef8c658 (git)
Affected: 3d026d09b28dda24777129a931634949c75a9181 , < ef06882c7d8a7400b67d0d003b1008093dd589ed (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/sta_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "9024c7729eb523cf4f3a4203966d3a4aaabf030d",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "9e06c9c8a1f10c55d9bc5d139656d58795e64483",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "20ee9c03f261bf6ac59331e2ca7b46b23646412a",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "b1bbeb8970eeb6c6bf3cd5314138103f7b69446d",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "d29a165588b6a0cf7a38db5cbd602aef7ef8c658",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            },
            {
              "lessThan": "ef06882c7d8a7400b67d0d003b1008093dd589ed",
              "status": "affected",
              "version": "3d026d09b28dda24777129a931634949c75a9181",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/sta_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Detach sync cmd buffer on interrupted wait\n\nmwifiex synchronous commands keep the caller-provided data buffer in\ncmd_node-\u003edata_buf. Several callers pass stack-allocated objects there.\n\nIf wait_event_interruptible_timeout() is interrupted, the caller can\nreturn and release that stack object while the firmware command is still\nthe current command. A late firmware response then reaches the normal\nresponse handler, which can copy data through cmd_node-\u003edata_buf into the\nstale stack address.\n\nThis fixes a stack corruption observed during repeated association and\ndisassociation cycles. The panic trace showed the command wait being\ninterrupted immediately before a bad pointer dereference:\n\n  cmd_wait_q terminated: -512\n  Unable to handle kernel paging request at virtual address 002c583837384662\n  Kernel panic - not syncing: stack-protector: Kernel stack is corrupted\n  ...\n  Tainted: [M]=MACHINE_CHECK\n\nThe fault address decodes as little-endian ASCII:\n\n  0x002c583837384662 -\u003e \"bF878X,\\0\"\n\nwhich is a fragment of the VERSION_EXT firmware string exposed as\ndebugfs \"verext\":\n\n  w8997o-V4, RF878X, FP92, 16.92.21.p153.7\n\nThe same runs also showed corrupted control data containing:\n\n  0x2400372e333531 -\u003e \"153.7\\0$\"\n\nwhich is the tail of the same VERSION_EXT string. This points at a late\nVERSION_EXT response writing through a stale stack-backed data_buf after\nthe interrupted wait returned.\n\nAfter cancelling pending commands on an interrupted or timed-out wait,\ndetach the caller-owned data buffer from the still-current command. This\npreserves the existing command cancellation behaviour while preventing a\nlate response from writing through a pointer whose lifetime ended with the\nwaiting caller.\n\nTested on an i.MX8MP board using an 88W8997."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The stale data_buf write is reached from local cfg80211/nl80211 and debugfs paths that call mwifiex_send_cmd(..., sync) and sleep in mwifiex_wait_queue_complete(), not from parsing received 802.11 frames, so this is a local syscall/ioctl issue rather than an adjacent RF or remote network vector.\nAC:L - The attacker issues a synchronous mwifiex command and signals the waiting thread (or races a second nl80211 dump against an in-flight command); cancel_all_pending_cmd() intentionally leaves curr_cmd queued for the firmware reply, so the late write-through data_buf does not depend on an uncontrolled race or layout.\nPR:L - NL80211_CMD_GET_STATION is unprivileged and still sends sync firmware commands whose interrupted wait runs mwifiex_cancel_all_pending_cmd() against curr_cmd; remain-on-channel and other cfg80211 ops need only CAP_NET_ADMIN, which is a low-privileged local role on mwifiex phones, Chromebooks, and embedded boards rather than init-namespace root.\nUI:N - The attacker performs the nl80211 or debugfs request and delivers the interrupting signal themselves; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The corruption hits host kernel stack or heap in the mwifiex command-response path and stays within the same kernel security authority, yielding local privilege escalation or a host panic rather than a VM, IOMMU, or sandbox escape.\nC:H - A late firmware response memcpy\u0027s through the dangling cmd_node-\u003edata_buf into reused kernel stack (VERSION_EXT copies 128 bytes) or a kfree\u0027d testmode hostcmd buffer (up to 2048 bytes), a use-after-free write that can be reclaimed for arbitrary kernel read.\nI:H - The same stale-pointer write smashes kernel stack frames or a freed heap object, which is exploitable for control-flow hijacking; the observed VERSION_EXT ASCII overwrite already tripped the stack protector.\nA:H - The bug was observed as a kernel paging fault and stack-protector panic (cmd_wait_q terminated: -512, Kernel panic - not syncing: stack-protector: Kernel stack is corrupted), which is a full host availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:05.396Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9024c7729eb523cf4f3a4203966d3a4aaabf030d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e06c9c8a1f10c55d9bc5d139656d58795e64483"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/20ee9c03f261bf6ac59331e2ca7b46b23646412a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1bbeb8970eeb6c6bf3cd5314138103f7b69446d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d29a165588b6a0cf7a38db5cbd602aef7ef8c658"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef06882c7d8a7400b67d0d003b1008093dd589ed"
        }
      ],
      "title": "wifi: mwifiex: Detach sync cmd buffer on interrupted wait",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80944",
    "datePublished": "2026-09-11T19:42:16.076Z",
    "dateReserved": "2026-08-26T14:34:25.803Z",
    "dateUpdated": "2026-09-14T11:59:05.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80944",
      "date": "2026-09-18",
      "epss": "0.00129",
      "percentile": "0.02918"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/marvell/mwifiex/sta_ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9024c7729eb523cf4f3a4203966d3a4aaabf030d",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e06c9c8a1f10c55d9bc5d139656d58795e64483",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "20ee9c03f261bf6ac59331e2ca7b46b23646412a",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b1bbeb8970eeb6c6bf3cd5314138103f7b69446d",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d29a165588b6a0cf7a38db5cbd602aef7ef8c658",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ef06882c7d8a7400b67d0d003b1008093dd589ed",
                    "status": "affected",
                    "version": "3d026d09b28dda24777129a931634949c75a9181",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/marvell/mwifiex/sta_ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.15"
                  },
                  {
                    "lessThan": "3.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Detach sync cmd buffer on interrupted wait\n\nmwifiex synchronous commands keep the caller-provided data buffer in\ncmd_node-\u003edata_buf. Several callers pass stack-allocated objects there.\n\nIf wait_event_interruptible_timeout() is interrupted, the caller can\nreturn and release that stack object while the firmware command is still\nthe current command. A late firmware response then reaches the normal\nresponse handler, which can copy data through cmd_node-\u003edata_buf into the\nstale stack address.\n\nThis fixes a stack corruption observed during repeated association and\ndisassociation cycles. The panic trace showed the command wait being\ninterrupted immediately before a bad pointer dereference:\n\n  cmd_wait_q terminated: -512\n  Unable to handle kernel paging request at virtual address 002c583837384662\n  Kernel panic - not syncing: stack-protector: Kernel stack is corrupted\n  ...\n  Tainted: [M]=MACHINE_CHECK\n\nThe fault address decodes as little-endian ASCII:\n\n  0x002c583837384662 -\u003e \"bF878X,\\0\"\n\nwhich is a fragment of the VERSION_EXT firmware string exposed as\ndebugfs \"verext\":\n\n  w8997o-V4, RF878X, FP92, 16.92.21.p153.7\n\nThe same runs also showed corrupted control data containing:\n\n  0x2400372e333531 -\u003e \"153.7\\0$\"\n\nwhich is the tail of the same VERSION_EXT string. This points at a late\nVERSION_EXT response writing through a stale stack-backed data_buf after\nthe interrupted wait returned.\n\nAfter cancelling pending commands on an interrupted or timed-out wait,\ndetach the caller-owned data buffer from the still-current command. This\npreserves the existing command cancellation behaviour while preventing a\nlate response from writing through a pointer whose lifetime ended with the\nwaiting caller.\n\nTested on an i.MX8MP board using an 88W8997."
          }
        ],
        "id": "CVE-2026-80944",
        "lastModified": "2026-09-14T13:18:50.287",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:18:59.923",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/20ee9c03f261bf6ac59331e2ca7b46b23646412a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9024c7729eb523cf4f3a4203966d3a4aaabf030d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e06c9c8a1f10c55d9bc5d139656d58795e64483"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b1bbeb8970eeb6c6bf3cd5314138103f7b69446d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d29a165588b6a0cf7a38db5cbd602aef7ef8c658"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ef06882c7d8a7400b67d0d003b1008093dd589ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T15:54:43+00:00",
      "cve": "CVE-2026-80944",
      "id": "CVE-2026-80944",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mwifiex: Detach sync cmd buffer on interrupted wait",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80944.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:05:50Z",
      "cve": "CVE-2026-80944",
      "id": "CVE-2026-80944",
      "initial_release_date": "2026-09-12T16:37:12Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "88",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80944",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80944.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.