CVE-2026-80944

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Detach sync cmd buffer on interrupted wait

mwifiex synchronous commands keep the caller-provided data buffer in

cmd_node->data_buf. Several callers pass stack-allocated objects there.

If wait_event_interruptible_timeout() is interrupted, the caller can

return and release that stack object while the firmware command is still

the current command. A late firmware response then reaches the normal

response handler, which can copy data through cmd_node->data_buf into the

stale stack address.

This fixes a stack corruption observed during repeated association and

disassociation cycles. The panic trace showed the command wait being

interrupted immediately before a bad pointer dereference:

cmd_wait_q terminated: -512

Unable to handle kernel paging request at virtual address 002c583837384662

Kernel panic - not syncing: stack-protector: Kernel stack is corrupted

...

Tainted: [M]=MACHINE_CHECK

The fau

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References