CVE-2026-80722: Linux Kernel Wi-Fi Privilege Escalation

CVE-2026-80722 Overview

CVE-2026-80722 is a vulnerability in the Linux kernel mac80211 subsystem affecting the Target Wake Time (TWT) implementation for Sub-1 GHz (S1G) Wi-Fi. The function ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual TWT agreement can reach ieee80211_s1g_rx_twt_setup() with a twt->length value that is shorter than the full struct ieee80211_twt_params. The individual path forwards this undersized structure to drv_add_twt_setup(), where both the tracepoint and the driver callback consume the complete parameter block rather than only req_type. The fix prevents passing short individual agreements to the driver.

Critical Impact
An adjacent network attacker within Wi-Fi range can send a crafted S1G TWT setup frame that causes the kernel driver to read beyond the validated frame data, threatening confidentiality, integrity, and availability of the affected system.

Affected Products

Linux kernel mac80211 subsystem
Kernel builds with S1G (Sub-1 GHz Wi-Fi/802.11ah) TWT support enabled
Wireless drivers consuming drv_add_twt_setup() parameters

Discovery Timeline

2026-08-28 - CVE-2026-80722 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80722

Vulnerability Analysis

The flaw resides in the S1G TWT setup handling path within Linux mac80211. When a station or access point receives a TWT action frame, ieee80211_process_rx_twt_action() performs preliminary validation and queues the frame for processing. The later handler, ieee80211_s1g_rx_twt_setup(), forwards the parsed TWT element to drv_add_twt_setup() for the individual agreement code path.

The validation performed prior to driver invocation does not confirm that the TWT element carries the full struct ieee80211_twt_params payload. The driver callback and its associated tracepoint read the entire parameters structure, including fields beyond req_type. This creates an out-of-bounds read condition when the frame supplies a truncated element.

Broadcast TWT agreements are not affected because the local handler rejects them after examining only req_type, so the short-frame condition never reaches the driver on that path.

Root Cause

The root cause is missing length validation for individual TWT agreements before passing the TWT parameters block to driver code. The parser accepts a twt->length value that is smaller than sizeof(struct ieee80211_twt_params), yet downstream consumers dereference the full structure. This is an input validation error leading to an out-of-bounds read.

Attack Vector

Exploitation requires an attacker to transmit a malformed S1G TWT setup action frame within Wi-Fi radio range of a vulnerable receiver. No authentication or user interaction is required. The crafted frame carries a TWT element with a length field shorter than the parameters structure expected by the driver, causing the wireless driver and its tracepoint to consume memory beyond the received frame content. Impact depends on the specific driver implementation and adjacent memory layout, but the advisory indicates full confidentiality, integrity, and availability consequences.

No verified public exploit code or proof of concept has been published. Refer to the upstream commits referenced below for the exact fix scope.

Detection Methods for CVE-2026-80722

Indicators of Compromise

Unexpected kernel warnings, oops messages, or crashes originating in mac80211 or wireless driver modules referencing twt or s1g symbols.
Anomalous S1G TWT setup action frames observed on 802.11ah-capable interfaces, particularly frames with truncated TWT elements.
Wireless driver tracepoints (drv_add_twt_setup) firing on frames of unusual size.

Detection Strategies

Monitor kernel logs for panics, KASAN reports, or WARN_ON traces referencing ieee80211_s1g_rx_twt_setup, drv_add_twt_setup, or associated tracepoints.
Correlate wireless interface anomalies with adjacent-network activity captured on managed access points.
Track kernel package versions across the fleet to identify hosts still exposed to the vulnerable code path.

Monitoring Recommendations

Enable KASAN or equivalent kernel memory sanitizers on test builds to surface out-of-bounds reads during regression testing.
Forward kernel telemetry and crash artifacts to a centralized log platform for correlation with wireless event data.
Alert on repeated wireless driver faults on hosts running S1G-capable radios.

How to Mitigate CVE-2026-80722

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits and rebuild affected distribution kernels.
Prioritize patching on systems using 802.11ah/S1G radios, including IoT gateways and embedded platforms.
Restrict physical and radio proximity to sensitive S1G-capable devices until patches are deployed.

Patch Information

The fix ensures that short individual TWT agreements are not passed to the driver. Patched commits are available upstream:

Consult your Linux distribution's security advisories for backported kernel packages.

Workarounds

Disable S1G/802.11ah radio interfaces on affected hosts where the feature is not required for operations.
Where possible, unload wireless driver modules that expose drv_add_twt_setup on systems that do not use TWT.
Segment S1G-capable devices onto isolated wireless networks to limit adjacent-network exposure until patches are applied.

bash

# Example: disable a wireless interface pending patch deployment
sudo ip link set dev wlan0 down

# Example: verify running kernel version against patched builds
uname -r