Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80944— wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于wifi mwifiex同步命令将调用者提供的栈缓冲区保存在cmd_node->data_buf，当wait_event_interruptible_timeout()被中断后调用者返回并释放栈对象，延迟的固件响应可能通过该指针写入已失效的栈地址，导致栈损坏和内核崩溃。

CVSS 7.8 · High EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 3d026d09b28dda24777129a931634949c75a9181< 8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9 affected
3d026d09b28dda24777129a931634949c75a9181< 9024c7729eb523cf4f3a4203966d3a4aaabf030d affected
3d026d09b28dda24777129a931634949c75a9181< 9e06c9c8a1f10c55d9bc5d139656d58795e64483 affected
3d026d09b28dda24777129a931634949c75a9181< f2134d6ff30cd6e1bf63d6b0a5d8e0839f0168b3 affected
3d026d09b28dda24777129a931634949c75a9181< 20ee9c03f261bf6ac59331e2ca7b46b23646412a affected
3d026d09b28dda24777129a931634949c75a9181< b1bbeb8970eeb6c6bf3cd5314138103f7b69446d affected
3d026d09b28dda24777129a931634949c75a9181< d29a165588b6a0cf7a38db5cbd602aef7ef8c658 affected
3d026d09b28dda24777129a931634949c75a9181< ef06882c7d8a7400b67d0d003b1008093dd589ed affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80944

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于wifi mwifiex同步命令将调用者提供的栈缓冲区保存在cmd_node->data_buf，当wait_event_interruptible_timeout()被中断后调用者返回并释放栈对象，延迟的固件响应可能通过该指针写入已失效的栈地址，导致栈损坏和内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3d026d09b28dda24777129a931634949c75a9181 ~ 8c67b8c50286e0cb7f18d667e6a37a2ec6e08ff9 -
Linux Linux 3.15 -

II. Public POCs for CVE-2026-80944

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80944

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80944 (7)

Other References for CVE-2026-80944 (1)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89688 9.8 CRITICAL nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89674 9.8 CRITICAL nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
CVE-2026-89675 9.8 CRITICAL nfsd: fix UAF in async copy cancel and shutdown
CVE-2026-89676 9.8 CRITICAL nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
CVE-2026-89677 9.8 CRITICAL nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
CVE-2026-89681 9.8 CRITICAL nfsd: fix layout fence worker double-reference race
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89702 9.8 CRITICAL nfsd: size fh_verify server sockaddr slot by xpt_locallen
CVE-2026-89703 9.8 CRITICAL nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80944

No comments yet

Leave a comment