CVE-2026-80943

The Linux kernel's rtlwifi rtl8192du driver, which supports Realtek RTL8192DU USB Wi-Fi adapters, reads the low 4-bit QoS TID from an outgoing 802.11 frame header (values 0-15) and uses it directly to index the per-station aggregation array sta_entry->tids[], which holds only 9 (MAX_TID_COUNT) entries. A frame transmitted with a TID greater than 8 therefore indexes past the end of the array, confirmed by UBSAN as an index-10 access against rtl_tid_data[9]. Because the TID derives from QoS traffic on the wireless link, a peer on the adjacent Wi-Fi network can craft traffic that triggers the out-of-bounds access; the CVSS 3.1 score of 7.1-class severity (7.6, AV:A) reflects high availability impact (kernel crash/instability) with low confidentiality and integrity impact. Only systems using RTL8192DU-based USB Wi-Fi hardware with the in-tree rtl8192du driver are affected, not other Wi-Fi chipsets or drivers. No public proof of concept exists, the flaw is not in the CISA KEV catalog, and no exploitation is known.

What to do: Update to a kernel release or distro package that includes the fix, which bounds-checks the TID and keeps the default RTL_AGG_STOP aggregation state for out-of-range values (matching the existing rtl92cu driver behavior); the patch will be backported to stable kernels. Until patched, avoid using RTL8192DU USB dongles on untrusted or hostile wireless networks. Verify exposure by checking for the driver ('lsmod | grep rtl8192du') or the CONFIG_RTL8192DU kernel config option together with such hardware being present.