CVE-2026-74340wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 43efa3c0f241e04862be8e6a68ff765d36cde1ba builds before 22b0b8572a64362531dd0ed499b75e16282aeb2b; 43efa3c0f241e04862be8e6a68ff765d36cde1ba builds before 3cf92b44c4fb88a5e8de8733a4494c0956606bca; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before 0907c06dccae9e3c8d5a68eb9014beec73a36e79; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before 64228dfc4247aca178c01e5a37af7d8dcc7a6089; 43efa3c0f241e04862be8e6a68ff765d36cde1ba builds before 23d210877968657bd07e1a517e0b516db20a1d80; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before f03782f7f41f2afee5076a1ef08ced5649218771; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before f987efff29a5fe45320ea5991c9d5cb98b676953; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before df2187acfca6c6cca372c5d35f42394d9c270b09 | CNA record |
References
- https://git.kernel.org/stable/c/22b0b8572a64362531dd0ed499b75e16282aeb2b
- https://git.kernel.org/stable/c/3cf92b44c4fb88a5e8de8733a4494c0956606bca
- https://git.kernel.org/stable/c/0907c06dccae9e3c8d5a68eb9014beec73a36e79
- https://git.kernel.org/stable/c/64228dfc4247aca178c01e5a37af7d8dcc7a6089
- https://git.kernel.org/stable/c/23d210877968657bd07e1a517e0b516db20a1d80
- https://git.kernel.org/stable/c/f03782f7f41f2afee5076a1ef08ced5649218771
- https://git.kernel.org/stable/c/f987efff29a5fe45320ea5991c9d5cb98b676953
- https://git.kernel.org/stable/c/df2187acfca6c6cca372c5d35f42394d9c270b09
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.