CVE-2026-80943

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

rtl92du tx fill desc() uses ieee80211 get tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta entry->tids[]. ieee80211 get tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15.

rtlwifi only allocates MAX TID COUNT entries for sta entry->tids[], and MAX TID COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL AGG STOP state for out-of-range TIDs, matching rtl92cu tx fill desc().

This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl tid data [9]'.