CVE-2026-80722

CVE-2026-80722 is a flaw in the Linux kernel's mac80211 Wi-Fi stack in which received S1G (802.11ah) Target Wake Time (TWT) setup action frames are only partially length-validated before being handed to wireless drivers. A device in radio range that sends a crafted S1G TWT setup frame with an individual agreement whose length field is too short for the full parameters structure causes the kernel to pass that short buffer to the driver's add-TWT-setup callback and the associated tracepoint, both of which consume the complete parameters block and can read past the end of the received frame. The attacker gains an out-of-bounds read of kernel memory; the CVSS 3.1 score of 8.8 (high) rates confidentiality, integrity, and availability impact as high, so memory disclosure or a kernel crash is plausible. Affected are Linux systems running mac80211-based Wi-Fi drivers that process S1G TWT setup frames — practically, S1G/Wi-Fi HaLow (802.11ah)-capable setups, since ordinary Wi-Fi configurations that never receive S1G action frames do not exercise this path. No exploitation is known: there is no public PoC, the flaw is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at roughly 0.2%.

What to do: Apply the upstream kernel commit fixing mac80211 S1G TWT validation via your distribution's stable/kernel update channel (no fixed version number is provided in the source data, so track vendor advisories). Check whether your systems run mac80211 Wi-Fi drivers with S1G (802.11ah)/TWT support; environments without S1G-capable radios are unlikely to be reachable. Until patched, restrict Wi-Fi HaLow-capable Linux hosts to trusted radio peers, since exploitation requires an adjacent attacker transmitting a crafted TWT setup frame.