CVE-2026-80641: Linux Kernel wlcore Privilege Escalation

CVE-2026-80641 Overview

CVE-2026-80641 is a Linux kernel vulnerability in the wlcore WiFi driver used by Texas Instruments WiLink chipsets. The flaw resides in the firmware version check that gates support for the Integrity Group Temporal Key (IGTK) cipher. On systems running older firmware, the check decrements the cipher count on every boot, progressively corrupting the driver's advertised cipher set. Affected devices such as wl128x and other non-wl18xx chips repeatedly fail key installation and enter hardware recovery loops when associating to standard access points. The issue was resolved upstream by disabling IGTK on wl12xx and correcting the decrement logic.

Critical Impact
The bug produces an endless hardware-recovery loop that prevents wireless clients from associating with access points, causing sustained loss of WiFi connectivity on affected TI WiLink devices.

Affected Products

Linux kernel wlcore WiFi driver
Texas Instruments wl12xx / wl128x WiFi chipsets
Systems running affected firmware (for example, Rev 7.3.10.0.142) with the wlcore driver

Discovery Timeline

2026-08-28 - CVE-2026-80641 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80641

Vulnerability Analysis

The defect lives in the wlcore driver logic introduced by commit c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key"). That commit added a firmware version check intended to enable the IGTK cipher only on firmware new enough to support it. The check runs on every driver initialization and decrements the reported cipher count when the firmware is deemed too old. Because the decrement is not idempotent, each boot shrinks the cipher list further, eventually removing ciphers the hardware actually supports.

The check also assumes the chip is a wl18xx and does not account for wl12xx or wl128x variants, which never support IGTK regardless of firmware. On these chips the kernel logs wlcore: WARNING could not set keys, followed by ERROR Could not add or replace key and failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-5). The driver then triggers hardware recovery via wl12xx_queue_recovery_work, which fires the WARNING at drivers/net/wireless/ti/wlcore/main.c:872 and repeats indefinitely.

Root Cause

The root cause is flawed state management in the cipher-enablement path. The firmware-gating logic mutates a persistent cipher set instead of computing it fresh at each boot, and it applies chip-agnostic assumptions to a chip-specific capability. This is a configuration and input-validation defect within the driver.

Attack Vector

The issue is not a remote code execution primitive. It manifests as a functional denial of service on the WiFi interface when the driver interacts with older firmware or non-wl18xx hardware. Exploitation requires no attacker action; the failure occurs during normal association with a standard access point.

No verified proof-of-concept code exists. See the upstream fixes in Kernel Git Commit 7495adaa0e and Kernel Git Commit ff97482006 for the corrective patches.

Detection Methods for CVE-2026-80641

Indicators of Compromise

Kernel log messages wlcore: WARNING could not set keys and wlcore: ERROR Could not add or replace key on hosts using TI WiLink hardware.
Repeating wlcore: Hardware recovery in progress. FW ver: Rev 7.3.10.0.142 entries followed by firmware booted cycles.
WARNING traces originating from wl12xx_queue_recovery_work+0x64/0x74 [wlcore] at drivers/net/wireless/ti/wlcore/main.c:872.

Detection Strategies

Parse dmesg and journalctl -k for the wlcore warning and error strings listed above across managed Linux fleets.
Correlate WiFi association failures with -5 (-EIO) key installation errors reported by mac80211.
Track kernel version and running firmware revision through configuration management to identify hosts on vulnerable wlcore builds.

Monitoring Recommendations

Forward kernel logs from embedded and IoT Linux endpoints to a centralized logging pipeline for pattern matching on the wlcore recovery signature.
Alert on repeated Hardware restart was requested events for the same phy interface within a short window.
Baseline wireless connectivity metrics so that sudden increases in association retries on TI WiLink devices are flagged for review.

How to Mitigate CVE-2026-80641

Immediate Actions Required

Update to a Linux kernel that includes the upstream fixes referenced in Kernel Git Commit 7495adaa0e and Kernel Git Commit ff97482006.
Inventory Linux systems using the wlcore, wl12xx, or wl18xx modules to prioritize patch deployment.
On appliances that cannot be updated quickly, plan controlled reboots to avoid the progressive cipher-set decrement.

Patch Information

The fix disables IGTK unconditionally on wl12xx and corrects the decrement logic so the cipher set is derived correctly at each boot. Apply the stable-tree commits 7495adaa0e45e180f4b6b7436675c6266edff1ff and ff9748200698e9641f41ba922ffef728167807c2, or upgrade to a distribution kernel that has backported them.

Workarounds

Upgrade device firmware to a version that supports IGTK where the hardware permits, reducing the chance of the version check taking the faulty path.
Where feasible, blacklist the wlcore module on affected devices and use an alternative wireless interface until the patched kernel is deployed.
Restrict wireless clients on impacted hardware to networks that do not require the ciphers being incorrectly stripped, as an operational stopgap only.

bash

# Verify running kernel and wlcore module status
uname -r
modinfo wlcore | grep -E '^(filename|version|srcversion)'
dmesg | grep -E 'wlcore|wl12xx|wl18xx'