Improper Initialization in Linux kernel - CVE-2026-80641
Published: August 28, 2026
Vulnerability identifier: #VU146154
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80641
CWE-ID: CWE-665
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in the wlcore wireless driver cipher suite handling when connecting to an access point with affected firmware and hardware combinations. A remote attacker can trigger repeated key setup failures to cause a denial of service.
The issue can lead to endless hardware recovery and restart cycles on some wl128x devices using older firmware.
Affected software
Linux kernel
How to mitigate CVE-2026-80641
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3