CVE-2026-80943

A flaw was found in the Linux kernel's rtlwifi driver. This vulnerability occurs when the rtl92dutxfilldesc function uses a Quality of Service QoS Traffic Identifier TID value greater than 8 as an index into an array that only has 9 allocated entries. A remote attacker could potentially exploit...

CVE-2026-80943

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943

CVE-2026-80943 affects the Linux kernel driver wifi: rtlwifi: rtl8192du . The function rtl92du_tx_fill_desc() reads a QoS TID (range 0–15) via ieee80211_get_tid() and uses it to index into sta_entry->tids[], which only has MAX_TID_COUNT (9) entries. A TID greater than 8 triggers an array-index...

EUVD-2026-76266

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

PT-2026-90073

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du tx fill desc uses ieee80211 get tid to read the QoS TID from the 802.11 header and then uses it as an index into sta entry-tids. ieee80211 get tid returns the l...