{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80944 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80944 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80944 and fix it if it is affected.\n\nWhat it is: CVE-2026-80944 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80944 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80944/ (Markdown: https://insights.sbomify.com/CVE-2026-80944/index.md)","id":"CVE-2026-80944","markdown":"https://insights.sbomify.com/CVE-2026-80944/index.md","name":"CVE-2026-80944","record":{"aliases":["AZL-100650","BELL-CVE-2026-80944","DEBIAN-CVE-2026-80944","GHSA-63w9-8935-246m","UBUNTU-CVE-2026-80944"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel Wi-Fi driver","requires_auth":"low_privilege","summary":"A use-after-free in the mwifiex Wi-Fi driver allows attackers to cause stack corruption and kernel panics via interrupted synchronous commands.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Detach sync cmd buffer on interrupted wait\n\nmwifiex synchronous commands keep the caller-provided data buffer in\ncmd_node-\u003edata_buf. Several callers pass stack-allocated objects there.\n\nIf wait_event_interruptible_timeout() is interrupted, the caller can\nreturn and release that stack object while the firmware command is still\nthe current command. A late firmware response then reaches the normal\nresponse handler, which can copy data through cmd_node-\u003edata_buf into the\nstale stack address.\n\nThis fixes a stack corruption observed during repeated association and\ndisassociation cycles. The panic trace showed the command wait being\ninterrupted immediately before a bad pointer dereference:\n\n  cmd_wait_q terminated: -512\n  Unable to handle kernel paging request at virtual address 002c583837384662\n  Kernel panic - not syncing: stack-protector: Kernel stack is corrupted\n  ...\n  Tainted: [M]=MACHINE_CHECK\n\nThe fault address decodes as little-endian ASCII:\n\n  0x002c583837384662 -\u003e \"bF878X,\\0\"\n\nwhich is a fragment of the VERSION_EXT firmware string exposed as\ndebugfs \"verext\":\n\n  w8997o-V4, RF878X, FP92, 16.92.21.p153.7\n\nThe same runs also showed corrupted control data containing:\n\n  0x2400372e333531 -\u003e \"153.7\\0$\"\n\nwhich is the tail of the same VERSION_EXT string. This points at a late\nVERSION_EXT response writing through a stale stack-backed data_buf after\nthe interrupted wait returned.\n\nAfter cancelling pending commands on an interrupted or timed-out wait,\ndetach the caller-owned data buffer from the still-current command. This\npreserves the existing command cancellation behaviour while preventing a\nlate response from writing through a pointer whose lifetime ended with the\nwaiting caller.\n\nTested on an i.MX8MP board using an 88W8997.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: mwifiex: Detach sync cmd buffer on interrupted wait","id":"CVE-2026-80944","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"crypto: iaa - unmap dst before software fallback on decompress","id":"CVE-2026-80945"},"packages":[],"prev":{"headline":"wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids","id":"CVE-2026-80943"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the mwifiex Wi-Fi driver allows attackers to cause stack corruption and kernel panics via interrupted synchronous commands.","url":"https://insights.sbomify.com/CVE-2026-80944/"}