In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: validate individual TWT params before driver setup

ieee80211 process rx twt action() only partially validates a received S1G TWT setup frame before queueing it.

An individual agreement can therefore reach ieee80211 s1g rx twt setup() with twt->length too short for the full struct ieee80211 twt params.

The individual path passes twt to drv add twt setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req type.

[edit commit message to not overclaim lack of validation nor understate driver impact]