CVE-2026-74341wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content. Add a bounds check on the response length.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8e84c25821698bdef73c0329fb2022a4673b7adc before dae9cadf0925f1cbfb71306d60490890df3870a6; from 8e84c25821698bdef73c0329fb2022a4673b7adc before cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92; from 8e84c25821698bdef73c0329fb2022a4673b7adc before 15545ee71301e82d26d9a31b407ed0019eb62a60; 8e84c25821698bdef73c0329fb2022a4673b7adc builds before 1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18; from 8e84c25821698bdef73c0329fb2022a4673b7adc before 18813b90032bfaafb225906a4d2b51be4dfc02c3; from 8e84c25821698bdef73c0329fb2022a4673b7adc before 88a240d86d3d64521f9194abe185ac71cc74d0bd | CNA record |
References
- https://git.kernel.org/stable/c/dae9cadf0925f1cbfb71306d60490890df3870a6
- https://git.kernel.org/stable/c/cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92
- https://git.kernel.org/stable/c/15545ee71301e82d26d9a31b407ed0019eb62a60
- https://git.kernel.org/stable/c/1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18
- https://git.kernel.org/stable/c/18813b90032bfaafb225906a4d2b51be4dfc02c3
- https://git.kernel.org/stable/c/88a240d86d3d64521f9194abe185ac71cc74d0bd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.