CVE-2026-74340

wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

State: Published
Severity: 8.1 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer.

Add a check that count fits within the received message.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 22b0b8572a64362531dd0ed499b75e16282aeb2bAffected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 3cf92b44c4fb88a5e8de8733a4494c0956606bcaAffected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 0907c06dccae9e3c8d5a68eb9014beec73a36e79Affected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 64228dfc4247aca178c01e5a37af7d8dcc7a6089Affected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 23d210877968657bd07e1a517e0b516db20a1d80Affected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before f03782f7f41f2afee5076a1ef08ced5649218771Affected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before f987efff29a5fe45320ea5991c9d5cb98b676953Affected 43efa3c0f241e04862be8e6a68ff765d36cde1ba to before df2187acfca6c6cca372c5d35f42394d9c270b09Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 22b0b8572a64362531dd0ed499b75e16282aeb2bAffected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 3cf92b44c4fb88a5e8de8733a4494c0956606bcaAffected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 0907c06dccae9e3c8d5a68eb9014beec73a36e79Affected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 64228dfc4247aca178c01e5a37af7d8dcc7a6089Affected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before 23d210877968657bd07e1a517e0b516db20a1d80Affected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before f03782f7f41f2afee5076a1ef08ced5649218771Affected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before f987efff29a5fe45320ea5991c9d5cb98b676953Affected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to before df2187acfca6c6cca372c5d35f42394d9c270b09Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.