{"apiVersion":"1.0","identifier":"CVE-2026-80722","description":"In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type. [edit commit message to not overclaim lack of validation nor understate driver impact]","publishedAt":"2026-08-28T08:16:58","lastModifiedAt":"2026-08-28T08:16:58","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80722","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00161,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-80722","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-80722","en":"https://www.redsauce.net/en/cves/CVE-2026-80722","fr":"https://www.redsauce.net/fr/cves/CVE-2026-80722","pt":"https://www.redsauce.net/pt/cves/CVE-2026-80722","de":"https://www.redsauce.net/de/cves/CVE-2026-80722","sk":"https://www.redsauce.net/sk/cves/CVE-2026-80722","el":"https://www.redsauce.net/el/cves/CVE-2026-80722"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-80722"}}