SB20260828129 - Improper Initialization in Linux kernel ti wlcore driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-80641)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the wlcore wireless driver cipher suite handling when connecting to an access point with affected firmware and hardware combinations. A remote attacker can trigger repeated key setup failures to cause a denial of service.

The issue can lead to endless hardware recovery and restart cycles on some wl128x devices using older firmware.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7495adaa0e45e180f4b6b7436675c6266edff1ff
• https://git.kernel.org/stable/c/ff9748200698e9641f41ba922ffef728167807c2