CVE-2026-80635wifi: wcn36xx: fix OOB read from short trigger BA firmware response
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 29, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 16be1ac55944412e8d132b1db26f994b368c5742 builds before 04aba50212f9f274e1a726fb3873b5ce8da2d821; from 16be1ac55944412e8d132b1db26f994b368c5742 before c07aa0534d50361183833e3803204044cf1d0476; from 16be1ac55944412e8d132b1db26f994b368c5742 before d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35; from 16be1ac55944412e8d132b1db26f994b368c5742 before af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee; from 16be1ac55944412e8d132b1db26f994b368c5742 before d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2; from 16be1ac55944412e8d132b1db26f994b368c5742 before b5e6f21923ca89d90256e7346301056f6502691e | CNA record |
References
- https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821
- https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476
- https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35
- https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee
- https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2
- https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.