CVE-2026-80722

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. A remote attacker sending a specially crafted S1G TWT setup frame could cause the system to process an incomplete parameters block. This incomplete processing can lead to memory corruption or a system crash, resulting in a Denial of Service (DoS).

A short individual S1G TWT setup frame can reach ieee80211_s1g_rx_twt_setup() with a length that is too small for the full ieee80211_twt_params block. The individual path then passes the TWT data to drv_add_twt_setup(), while the tracepoint and driver callback may consume the complete parameter block and read beyond the validated frame contents. For the CVSS the PR:N is used because the attacker does not need local privileges on the victim and only needs radio reachability to the affected Wi-Fi interface. The vector is AV:A rather than AV:N because exploitation requires 802.11 adjacency and is not a normal routed network attack. Impact is at least adjacent-network denial of service risk and possible limited confidentiality or integrity impact from out-of-bounds reads or driver-dependent handling, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.