CVE-2026-80722: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-80722 is a memory disclosure vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem, specifically in the S1G Target Wake Time (TWT) setup frame processing. The flaw arises because ieee80211_process_rx_twt_action() only partially validates received S1G TWT setup frames before queuing them, allowing an individual agreement to reach ieee80211_s1g_rx_twt_setup() with a twt->length value too short for the full ieee80211_twt_params structure. Affected kernel versions begin at commit f5a4c24e689f (introduced with Linux 5.15) and are fixed in stable releases 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2. The vulnerability was published on August 28, 2026, with patches available the same day. The CVSS base score is currently listed as 0.0 (pending full scoring), with Feedly estimating a Medium severity (GitHub Advisory, Feedly).

The root cause is insufficient input validation (CWE-20) in the Linux kernel's mac80211 module when processing individual S1G TWT setup frames over Wi-Fi. When ieee80211_process_rx_twt_action() receives a TWT setup frame, it queues individual agreements without fully verifying that twt->length is large enough to contain the complete ieee80211_twt_params structure. The incomplete frame is then passed to drv_add_twt_setup(), where both the kernel tracepoint and the driver callback attempt to consume the full parameters block — not just the req_type field — potentially resulting in an out-of-bounds memory read. Broadcast agreements are unaffected because they are rejected locally after accessing only req_type. The fix adds a length check for individual agreements before they are forwarded to the driver (GitHub Advisory, Kernel Patch).

Successful exploitation can lead to out-of-bounds memory access in the kernel, resulting in potential memory disclosure of kernel memory contents to an attacker within Wi-Fi range. The vulnerability is exploitable by an unauthenticated attacker who can transmit a malformed S1G TWT setup frame to a vulnerable access point or station, requiring no prior authentication or user interaction. While the primary impact is memory disclosure (confidentiality), the out-of-bounds read could also contribute to system instability, and depending on driver implementation, may have broader implications for kernel integrity (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires physical or network proximity (Wi-Fi range) to send a crafted S1G TWT frame, which limits the attack surface to environments using S1G (802.11ah) Wi-Fi.

Apply the available kernel patches, which add validation of twt->length for individual TWT agreements before passing them to the driver. Fixed versions are available across all active stable branches: 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2. As a workaround where patching is not immediately possible, disabling S1G (802.11ah) Wi-Fi functionality or restricting access to trusted Wi-Fi clients can reduce exposure. Administrators should prioritize updating kernel packages through their distribution's package manager (GitHub Advisory, Kernel Patch).