CVE-2026-80944

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can lead to a system crash (kernel panic), resulting in a Denial of Service (DoS).

A stale stack backed buffer in mwifiex synchronous command handling can remain attached to the current command after wait_event_interruptible_timeout is interrupted. A late firmware response can then write through cmd_node data_buf after the waiting caller has returned, corrupting freed kernel stack memory and causing stack protector panic or bad pointer dereference. For the CVSS the PR:L is used for the paranoid score because a local user or local network management process may be able to trigger WiFi control plane commands and interrupt the waiting path, even though some direct operations may require CAP_NET_ADMIN in locked down deployments. The issue is not directly network reachable and is not triggered by normal packet traffic alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.