EUVD-2026-67457
GHSA-h7fr-f2m3-rhpf
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent wireless vector correct; no authentication or interaction needed to send 802.11ah management frames; all three impacts plausible from unchecked driver memory access on truncated buffer.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: validate individual TWT params before driver setup
ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it.
An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params.
The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.
[edit commit message to not overclaim lack of validation nor understate driver impact]
AnalysisAI
Insufficient validation of S1G (802.11ah/Wi-Fi HaLow) Target Wake Time setup frames in the Linux kernel's mac80211 subsystem allows an unauthenticated adjacent-network attacker to submit a malformed individual TWT agreement whose parameter block is shorter than the full struct ieee80211_twt_params. The driver callback drv_add_twt_setup() and associated kernel tracepoint both consume the complete parameters structure regardless of the truncated length, potentially triggering kernel memory corruption, out-of-bounds reads exposing sensitive kernel memory, or a denial-of-service crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Linux system must have S1G (IEEE 802.11ah/Wi-Fi HaLow) capable hardware with the mac80211 driver loaded and at least one S1G wireless interface in an active state that accepts management frames. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score captures adjacent-network reachability with no privileges or user interaction and high CIA impact - but substantially overstates practical risk for most organizations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched stable kernel release: 5.15.216 or later on the 5.15.x branch, 6.1.183 or later, 6.6.151 or later, 6.12.103 or later, 6.18.44 or later, 7.1.8 or later, or 7.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using S1G (802.11ah/Wi-Fi HaLow) hardware in your infrastructure and document their Linux kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today