CVE-2026-80944 - Vulnerability Details

- wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Detach sync cmd buffer on interrupted wait

mwifiex synchronous commands keep the caller-provided data buffer in
cmd_node->data_buf. Several callers pass stack-allocated objects there.

If wait_event_interruptible_timeout() is interrupted, the caller can
return and release that stack object while the firmware command is still
the current command. A late firmware response then reaches the normal
response handler, which can copy data through cmd_node->data_buf into the
stale stack address.

This fixes a stack corruption observed during repeated association and
disassociation cycles. The panic trace showed the command wait being
interrupted immediately before a bad pointer dereference:

cmd_wait_q terminated: -512
Unable to handle kernel paging request at virtual address 002c583837384662
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
...
Tainted: [M]=MACHINE_CHECK

The fault address decodes as little-endian ASCII:

0x002c583837384662 -> "bF878X,\0"

which is a fragment of the VERSION_EXT firmware string exposed as
debugfs "verext":

w8997o-V4, RF878X, FP92, 16.92.21.p153.7

The same runs also showed corrupted control data containing:

0x2400372e333531 -> "153.7\0$"

which is the tail of the same VERSION_EXT string. This points at a late
VERSION_EXT response writing through a stale stack-backed data_buf after
the interrupted wait returned.

After cancelling pending commands on an interrupted or timed-out wait,
detach the caller-owned data buffer from the still-current command. This
preserves the existing command cancellation behaviour while preventing a
late response from writing through a pointer whose lifetime ended with the
waiting caller.

Tested on an i.MX8MP board using an 88W8997.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the mwifiex driver in the Linux kernel. It occurs when a synchronous Wi‑Fi command stores a caller‑supplied buffer on the stack and an interrupted wait allows the command to finish after the caller has returned, leaving a dangling pointer. This is a buffer over-read / stale pointer that leads to memory corruption (CWE‑787). A subsequent firmware response writes into this stale buffer, corrupting the kernel stack and causing a panic.

Affected Systems

Any Linux kernel that contains the mwifiex driver and runs Wi‑Fi firmware capable of association/disassociation cycles is affected. The flaw was observed on an i.MX8MP board with an 88W8997 adapter, but the issue exists in all kernels before the recent patch that detaches the caller‑owned buffer when a wait is interrupted.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to trigger a Wi‑Fi firmware command that is interrupted on a vulnerable machine, leading to a kernel panic and loss of availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3d026d09b28dda24777129a931634949c75a9181`	affected	< 8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9
`3d026d09b28dda24777129a931634949c75a9181`	affected	< 9024c7729eb523cf4f3a4203966d3a4aaabf030d
`3d026d09b28dda24777129a931634949c75a9181`	affected	< 9e06c9c8a1f10c55d9bc5d139656d58795e64483
`3d026d09b28dda24777129a931634949c75a9181`	affected	< f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3
`3d026d09b28dda24777129a931634949c75a9181`	affected	< 20ee9c03f261bf6ac59331e2ca7b46b23646412a
`3d026d09b28dda24777129a931634949c75a9181`	affected	< b1bbeb8970eeb6c6bf3cd5314138103f7b69446d
`3d026d09b28dda24777129a931634949c75a9181`	affected	< d29a165588b6a0cf7a38db5cbd602aef7ef8c658
`3d026d09b28dda24777129a931634949c75a9181`	affected	< ef06882c7d8a7400b67d0d003b1008093dd589ed

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3d026d09b28dda24777129a931634949c75a9181,20ee9c03f261bf6ac59331e2ca7b46b23646412a)`	affected	code_commit	—
`[3d026d09b28dda24777129a931634949c75a9181,b1bbeb8970eeb6c6bf3cd5314138103f7b69446d)`	affected	code_commit	—
`[3d026d09b28dda24777129a931634949c75a9181,d29a165588b6a0cf7a38db5cbd602aef7ef8c658)`	affected	code_commit	—
`[3d026d09b28dda24777129a931634949c75a9181,ef06882c7d8a7400b67d0d003b1008093dd589ed)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.15`	affected	generic	—
`[0,3.15)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the mwifiex driver fix that detaches the caller‑owned buffer when a wait is interrupted.
If a kernel upgrade is not immediately possible, unload or disable the mwifiex module to prevent the driver from loading and running into the fault.
Reduce the frequency of association/disassociation cycles on the Wi‑Fi device to minimize the chance of a late firmware response while a wait is interrupted.
Monitor kernel logs for panic events or stack‑corruption indications and update firmware or driver versions as vendor advisories become available.

Generated by OpenCVE AI on September 21, 2026 at 03:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/20ee9c03f261bf6ac59331e2ca7b46b23646412a
https://git.kernel.org/stable/c/8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9
https://git.kernel.org/stable/c/9024c7729eb523cf4f3a4203966d3a4aaabf030d
https://git.kernel.org/stable/c/9e06c9c8a1f10c55d9bc5d139656d58795e64483
https://git.kernel.org/stable/c/b1bbeb8970eeb6c6bf3cd5314138103f7b69446d
https://git.kernel.org/stable/c/d29a165588b6a0cf7a38db5cbd602aef7ef8c658
https://git.kernel.org/stable/c/ef06882c7d8a7400b67d0d003b1008093dd589ed
https://git.kernel.org/stable/c/f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3
https://nvd.nist.gov/vuln/detail/CVE-2026-80944
https://www.cve.org/CVERecord?id=CVE-2026-80944

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9 https://git.kernel.org/stable/c/9024c7729eb523cf4f3a4203966d3a4aaabf030d https://git.kernel.org/stable/c/9e06c9c8a1f10c55d9bc5d139656d58795e64483 https://git.kernel.org/stable/c/f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80944 https://www.cve.org/CVERecord?id=CVE-2026-80944
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997.
Title		wifi: mwifiex: Detach sync cmd buffer on interrupted wait
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/20ee9c03f261bf6ac59331e2ca7b46b23646412a https://git.kernel.org/stable/c/b1bbeb8970eeb6c6bf3cd5314138103f7b69446d https://git.kernel.org/stable/c/d29a165588b6a0cf7a38db5cbd602aef7ef8c658 https://git.kernel.org/stable/c/ef06882c7d8a7400b67d0d003b1008093dd589ed

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:16.076Z

Updated: 2026-09-14T11:59:05.396Z

Reserved: 2026-08-26T14:34:25.803Z

Link: CVE-2026-80944

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:18:59.923

Modified: 2026-09-14T13:18:50.287

Link: CVE-2026-80944

Redhat

Severity : Important

Publid Date: 2026-09-11T19:42:16Z

Links: CVE-2026-80944 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T04:00:13Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object