CVE-2026-80944: Linux Kernel mwifiex Use-After-Free Vulnerability

CVE-2026-80944 Overview

CVE-2026-80944 is a stack corruption vulnerability in the Linux kernel's mwifiex Wi-Fi driver. The flaw affects synchronous command handling in the Marvell 88W8xxx wireless chipset driver. When wait_event_interruptible_timeout() is interrupted, the caller can return and release a stack-allocated buffer while the firmware command remains active. A late firmware response then writes through the stale cmd_node->data_buf pointer into freed stack memory. The issue was observed during repeated association and disassociation cycles on an i.MX8MP board using an 88W8997 chip, producing kernel stack-protector panics.

Critical Impact
A late firmware response can corrupt kernel stack memory after an interrupted wait, leading to kernel panic or potential local privilege escalation on systems using the mwifiex driver.

Affected Products

Linux kernel builds including the mwifiex wireless driver
Systems using Marvell 88W8xxx Wi-Fi chipsets (e.g., 88W8997)
Embedded platforms such as i.MX8MP boards with Marvell Wi-Fi

Discovery Timeline

2026-09-11 - CVE-2026-80944 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80944

Vulnerability Analysis

The mwifiex driver implements synchronous command dispatch by storing the caller-provided data buffer pointer in cmd_node->data_buf. Several callers pass stack-allocated objects into this field. The calling thread then waits for firmware completion via wait_event_interruptible_timeout().

When a signal interrupts the wait, the function returns -512 (-ERESTARTSYS) and the caller unwinds its stack frame. The command remains registered as the current firmware command. When the firmware later returns a response, the driver's normal response handler copies data through cmd_node->data_buf into the caller's now-invalid stack address.

The reported panic trace showed the fault address decoding as little-endian ASCII fragments (bF878X,\0 and 153.7\0$) taken from the VERSION_EXT firmware string exposed via the verext debugfs entry. This confirmed a late VERSION_EXT response writing into a stale stack-backed data_buf.

Root Cause

The driver does not detach caller-owned buffers from the current command when the waiting thread is interrupted or times out. The command lifetime and the caller's stack lifetime become decoupled, producing a use-after-return condition on the data buffer pointer.

Attack Vector

Exploitation requires local access with the ability to interrupt kernel waits, for example by delivering signals during Wi-Fi association or disassociation operations. A local attacker who can influence timing of mwifiex synchronous commands can trigger memory corruption in the kernel stack. Successful exploitation results in denial of service via kernel panic, with potential for privilege escalation depending on the corrupted stack contents.

The upstream fix cancels pending commands on an interrupted or timed-out wait and detaches the caller-owned data_buf from the still-current command, preventing late responses from writing through the stale pointer. See the kernel commit series for the code-level change.

Detection Methods for CVE-2026-80944

Indicators of Compromise

Kernel log entries containing cmd_wait_q terminated: -512 followed by paging faults
Kernel panic messages referencing stack-protector: Kernel stack is corrupted
Faulting virtual addresses that decode to ASCII fragments of the firmware VERSION_EXT string
Machine check taint flag [M]=MACHINE_CHECK appearing after mwifiex activity

Detection Strategies

Monitor dmesg and journalctl -k output for mwifiex command timeout messages combined with subsequent stack-protector panics.
Correlate crashes with Wi-Fi association or disassociation events on systems using Marvell 88W8xxx hardware.
Track kernel version and loaded module signatures to identify hosts running unpatched mwifiex builds.

Monitoring Recommendations

Aggregate kernel crash telemetry from Linux endpoints into a centralized logging pipeline for pattern analysis.
Alert on repeated Wi-Fi driver command timeouts on the same host, which may indicate exploitation attempts.
Baseline normal Wi-Fi association behavior on embedded and mobile Linux devices to spot anomalous reconnection storms.

How to Mitigate CVE-2026-80944

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor builds are available.
Inventory Linux systems using the mwifiex driver, particularly embedded devices with Marvell 88W8xxx chipsets.
Restrict local access on affected hosts until patched kernels are deployed.

Patch Information

The fix is distributed across multiple stable branches. Relevant commits include 20ee9c0, 8c67b8c, 9024c77, 9e06c9c, b1bbeb8, d29a165, ef06882, and f2134d6. Rebuild or update to a distribution kernel containing the fix.

Workarounds

Unload the mwifiex module (modprobe -r mwifiex) on systems that do not require Marvell Wi-Fi functionality.
Disable interfaces backed by the affected driver via ip link set <iface> down until a patched kernel is installed.
Avoid workflows that repeatedly cycle Wi-Fi association state on unpatched systems.

bash

# Verify whether mwifiex is loaded and unload if unused
lsmod | grep mwifiex
sudo modprobe -r mwifiex_sdio mwifiex_pcie mwifiex

# Confirm kernel version after applying vendor update
uname -r