{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80641 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80641 is a denial of service vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80641 and fix it if it is affected.\n\nWhat it is: CVE-2026-80641 is a denial of service vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80641 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80641/ (Markdown: https://insights.sbomify.com/CVE-2026-80641/index.md)","id":"CVE-2026-80641","markdown":"https://insights.sbomify.com/CVE-2026-80641/index.md","name":"CVE-2026-80641","record":{"aliases":["DEBIAN-CVE-2026-80641","GHSA-6gg5-jm4h-xvvc","UBUNTU-CVE-2026-80641"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel Wi-Fi driver","requires_auth":"none","summary":"A logic error in the wlcore Wi-Fi driver causes endless hardware recovery loops, leading to denial of service for wireless connections.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: enable the right set of ciphers\n\nThe firmware version number check for IGTK introduced in\ncommit c34dbc5900b0 (\"wifi: wlcore: Add support for IGTK key\")\n\nlets the amount of ciphers decrease on every boot of a too old firmware and\nthat is practically happening. It also does not take into account other\nchips than the wl18xx. On some wl128x, the following can be observed\nwhen connecting via nm to a common ap:\n\n[  484.113311] wlcore: WARNING could not set keys\n[  484.117828] wlcore: ERROR Could not add or replace key\n[  484.123016] wlan0: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-5)\n[  484.123046] wlcore: Hardware recovery in progress. FW ver: Rev 7.3.10.0.142\n[  484.139923] wlcore: pc: 0x0, hint_sts: 0x00000048 count: 1\n[  484.145721] wlcore: down\n[  484.148986] ieee80211 phy0: Hardware restart was requested\n[  484.610473] wlcore: firmware booted (Rev 7.3.10.0.142)\n[  484.633758] wlcore: Association completed.\n[  484.690490] wlcore: ERROR command execute failure 14\n[  484.690490] ------------[ cut here ]------------\n[  484.700195] WARNING: drivers/net/wireless/ti/wlcore/main.c:872 at wl12xx_queue_recovery_work+0x64/0x74 [wlcore], CPU#0: kworker/0:0/892\n\nThis repeats endlessly.\nAlways disable IGTK on wl12xx and fix the decrementing mess.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: wlcore: enable the right set of ciphers","id":"CVE-2026-80641","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"liveupdate: Reference count incoming FLB data","id":"CVE-2026-80642"},"packages":[],"prev":{"headline":"cxl/fwctl: Fix __fortify_panic","id":"CVE-2026-80640"},"products":["Linux"],"published":"2026-08-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-28","vendors":["Linux"]},"summary":"A logic error in the wlcore Wi-Fi driver causes endless hardware recovery loops, leading to denial of service for wireless connections.","url":"https://insights.sbomify.com/CVE-2026-80641/"}