CVE-2026-80943: Linux Kernel rtlwifi Buffer Overflow Vulnerability

CVE-2026-80943 Overview

CVE-2026-80943 is an out-of-bounds array access vulnerability in the Linux kernel's rtlwifi driver for Realtek RTL8192DU wireless chipsets. The flaw resides in rtl92du_tx_fill_desc(), which calls ieee80211_get_tid() to extract the Quality of Service (QoS) Traffic Identifier (TID) from an 802.11 header. The function returns a 4-bit value in the range 0–15, but the driver indexes it into sta_entry->tids[], an array sized to MAX_TID_COUNT (9). A QoS TID greater than 8 reads past the aggregation state array. Undefined Behavior Sanitizer (UBSAN) validation confirmed an array-index-out-of-bounds access with index 10 on type rtl_tid_data[9].

Critical Impact
An adjacent-network attacker sending crafted 802.11 QoS frames can trigger kernel memory corruption or a denial-of-service condition on hosts using the RTL8192DU wireless driver.

Affected Products

Linux kernel rtlwifi driver for Realtek RTL8192DU USB Wi-Fi adapters
Kernel branches receiving the fix commits 0c0b374, 42785f7, 6e327f1, and ed4f05d
Linux distributions shipping vulnerable kernel builds prior to backport

Discovery Timeline

2026-09-11 - CVE-2026-80943 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80943

Vulnerability Analysis

The defect lives in drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c. The transmit-descriptor fill routine rtl92du_tx_fill_desc() reads a QoS TID directly from the outbound 802.11 header using ieee80211_get_tid(). That helper masks and returns the raw 4-bit TID field, which permits values 0 through 15.

The driver then uses this value as an index into sta_entry->tids[]. The array is dimensioned by MAX_TID_COUNT, which is 9 in rtlwifi. A TID value between 9 and 15 therefore reads or writes outside the array bounds. UBSAN reported the out-of-bounds access with index 10 against rtl_tid_data[9].

Because the driver processes frames destined for transmission, an attacker on the same wireless segment can influence the header contents that populate this descriptor path. The corrupted read can leak adjacent kernel heap contents or destabilize the aggregation state machine, leading to kernel panics.

Root Cause

The root cause is missing input validation between an 802.11 protocol field and a fixed-size driver array. The fix, mirroring behavior already present in rtl92cu_tx_fill_desc(), keeps the default RTL_AGG_STOP state for out-of-range TIDs rather than indexing the tids[] array. This is an Out-of-Bounds Read/Write defect [CWE-125/CWE-787] rooted in Improper Input Validation.

Attack Vector

Exploitation requires adjacency to the target on a wireless network (attack vector AV:A). No authentication or user interaction is needed. An attacker crafts 802.11 QoS data frames whose TID subfield in the QoS Control header carries a value greater than 8. When the RTL8192DU driver processes the frame through its transmit path, the out-of-bounds index is triggered.

The vulnerability manifests through normal driver code paths handling QoS-tagged traffic. See the upstream kernel commits linked in the Kernel Git Commit 0c0b374 and Kernel Git Commit 6e327f1 for the corrective patch.

Detection Methods for CVE-2026-80943

Indicators of Compromise

Kernel log entries from UBSAN reporting array-index-out-of-bounds in rtl_tid_data or within rtl92du_tx_fill_desc
Unexpected kernel oops or panic traces referencing rtlwifi or rtl8192du modules
System instability on hosts using Realtek RTL8192DU USB Wi-Fi adapters when receiving QoS-tagged wireless traffic

Detection Strategies

Enable CONFIG_UBSAN_BOUNDS on test kernels to surface out-of-bounds indexing in the rtlwifi transmit path
Correlate kernel ring buffer messages (dmesg) with wireless interface identifiers to detect abnormal aggregation state resets
Inventory endpoints for the loaded rtl8192du kernel module using configuration management tooling

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel facility events to a centralized log platform for anomaly detection
Alert on repeated wireless driver faults tied to specific 802.11 source MAC addresses, which may indicate targeted frame injection
Monitor for unexpected reboots or wireless connectivity loss on Linux endpoints using Realtek USB Wi-Fi hardware

How to Mitigate CVE-2026-80943

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 0c0b374, 42785f7, 6e327f1, and ed4f05d or update to a distribution kernel that includes them
Identify hosts using the rtl8192du driver by running lsmod | grep rtl8192du across the fleet
Prioritize patching for laptops, kiosks, and IoT devices operating in untrusted wireless environments

Patch Information

The fix keeps the aggregation state machine in RTL_AGG_STOP when the QoS TID exceeds MAX_TID_COUNT - 1, matching the safe handling already present in rtl92cu_tx_fill_desc(). Patch references: Kernel Git Commit 0c0b374, Kernel Git Commit 42785f7, Kernel Git Commit 6e327f1, and Kernel Git Commit ed4f05d.

Workarounds

Blacklist the rtl8192du kernel module on systems that do not require this specific Realtek adapter
Disable or physically remove RTL8192DU USB wireless adapters until patched kernels are deployed
Restrict use of affected devices to trusted wireless networks where hostile 802.11 frame injection is unlikely

bash

# Blacklist the vulnerable driver until a patched kernel is deployed
echo 'blacklist rtl8192du' | sudo tee /etc/modprobe.d/blacklist-rtl8192du.conf
sudo rmmod rtl8192du 2>/dev/null || true
sudo update-initramfs -u