From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD37A3D25CC for ; Fri, 28 Aug 2026 06:50:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899861; cv=none; b=cea6IwVz0BOM3vym+X0N7u4xHH70I4BN4sfuNco7UZ2wbHkfYwnBXN4wP/Fie8SxodGc5fhUt54jRhS0Lf0vN2UY74zEzcw3Nvz9FQDWZSwWRiKHmpEEPVst+GdH89fUuTtiI3jYYPcEd9Jutoz8PnXkjCSHN11X1u4DMkqIVgo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899861; c=relaxed/simple; bh=St2rkmBEXWvTCj5QnTLMKOMa+DnSxAiUT4DCAa5mnCw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sWvgcE4ZES52JGoKHnrtIKQe62xkvgKsHwPP4AR9SB7ajRI+IOVniLscMBkcsxxHcXGajp8G4WD8ThhpU3AJpsQ891JV6LLQDsVwcBqWNRum3wevrXKY2QZLNoIVwWUNsi4zSzNEmLBzewVO/nTEjQDomDs1Em+toR46dbFXYXw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=I/Mhixmc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="I/Mhixmc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33C441F000E9; Fri, 28 Aug 2026 06:50:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787899859; bh=PkVr4kxC3M5yUDnwZG2JbM2oQc1TVfoJJNM0Sm05cvc=; h=From:To:Cc:Subject:Date:Reply-To; b=I/MhixmczM1NmsXkjg3KP0tpNCrjpDkg+cYnReArClKv7OcU3OHCs07ClzJN6rz1q Wfd+TAoawHK9IUJVppboNswK1sBkcPvRaBAQH1mfjnuLUE8/Iqbzz22j5buQcxWTGG wjtDN0C8GLcLukbz0YYpAgpGaYUzXQgmY5/ouxpU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80641: wifi: wlcore: enable the right set of ciphers Date: Fri, 28 Aug 2026 08:49:18 +0200 Message-ID: <2026082841-CVE-2026-80641-6ff8@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3017; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=lUMUrfAn7rypdjMB9eFq/ZwJwhPY0ERRQIDvop9cfak=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkT9T3vZC84mxvnGGn6IHfm/uCGwN+XjWYeCeC6l97Vf 8bS7l9JRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAFxkJsN83+c/bur8z+t9V6jI tXTPvwj30skpDAv2TrzrdUN4udSF/MaHbNyeIgK3TxcAAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key") lets the amount of ciphers decrease on every boot of a too old firmware and that is practically happening. It also does not take into account other chips than the wl18xx. On some wl128x, the following can be observed when connecting via nm to a common ap: [ 484.113311] wlcore: WARNING could not set keys [ 484.117828] wlcore: ERROR Could not add or replace key [ 484.123016] wlan0: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-5) [ 484.123046] wlcore: Hardware recovery in progress. FW ver: Rev 7.3.10.0.142 [ 484.139923] wlcore: pc: 0x0, hint_sts: 0x00000048 count: 1 [ 484.145721] wlcore: down [ 484.148986] ieee80211 phy0: Hardware restart was requested [ 484.610473] wlcore: firmware booted (Rev 7.3.10.0.142) [ 484.633758] wlcore: Association completed. [ 484.690490] wlcore: ERROR command execute failure 14 [ 484.690490] ------------[ cut here ]------------ [ 484.700195] WARNING: drivers/net/wireless/ti/wlcore/main.c:872 at wl12xx_queue_recovery_work+0x64/0x74 [wlcore], CPU#0: kworker/0:0/892 This repeats endlessly. Always disable IGTK on wl12xx and fix the decrementing mess. The Linux kernel CVE team has assigned CVE-2026-80641 to this issue. Affected and fixed versions =========================== Issue introduced in 7.0 with commit c34dbc5900b0158edaab51c481510d66679d8f72 and fixed in 7.1.5 with commit ff9748200698e9641f41ba922ffef728167807c2 Issue introduced in 7.0 with commit c34dbc5900b0158edaab51c481510d66679d8f72 and fixed in 7.2 with commit 7495adaa0e45e180f4b6b7436675c6266edff1ff Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80641 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/ti/wlcore/main.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ff9748200698e9641f41ba922ffef728167807c2 https://git.kernel.org/stable/c/7495adaa0e45e180f4b6b7436675c6266edff1ff