EUVD-2026-76266
GHSA-8f9m-rj4x-3w9p
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Adjacent-only vector; no auth needed to send crafted 802.11 frames; OOB access yields kernel crash (A:H) with minor memory side-effects (C:L/I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15.
rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc().
This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'.
AnalysisAI
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's rtl92du_tx_fill_desc() function passes a raw 802.11 QoS TID value (range 0-15) as an index into sta_entry->tids[], which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system has a Realtek RTL8192DU USB Wi-Fi adapter physically attached and the rtl8192du kernel module loaded and active; (2) the attacker is on the same 802.11 wireless network segment as the target (adjacent access vector - remote internet exploitation is not possible); (3) the adapter is processing QoS data frames, which is standard in QoS-enabled Wi-Fi networks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H correctly reflects that exploitation is constrained to the adjacent wireless network segment - an internet-remote attacker cannot trigger this without physical or logical proximity to the target's Wi-Fi segment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 as appropriate for your distribution. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using the rtl8192du Wi-Fi driver and assess exposure in untrusted network environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today