CVE-2026-80944

CVE CVE-2026-80944EUVD EUVD-2026-76267Published 2026-09-11T19:42:16.000ZLast changed 2026-09-14T11:59:05.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 3d026d09b28dda24777129a931634949c75a9181 <f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3; 3d026d09b28dda24777129a931634949c75a9181 <9024c7729eb523cf4f3a4203966d3a4aaabf030d; patch: 5.10.270; 3d026d09b28dda24777129a931634949c75a9181 <20ee9c03f261bf6ac59331e2ca7b46b23646412a; 3d026d09b28dda24777129a931634949c75a9181 <9e06c9c8a1f10c55d9bc5d139656d58795e64483; patch: 6.6.157; 3d026d09b28dda24777129a931634949c75a9181 <ef06882c7d8a7400b67d0d003b1008093dd589ed; patch: 6.12.109; patch: 6.1.188; patch: 5.15.221; patch: 6.18.50; 3d026d09b28dda24777129a931634949c75a9181 <d29a165588b6a0cf7a38db5cbd602aef7ef8c658; patch: 7.3-rc1; patch: 7.2.4; patch: 0; 3.15; 3d026d09b28dda24777129a931634949c75a9181 <b1bbeb8970eeb6c6bf3cd5314138103f7b69446d; 3d026d09b28dda24777129a931634949c75a9181 <8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.