CVE-2026-74341

wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content.

Add a bounds check on the response length.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8e84c25821698bdef73c0329fb2022a4673b7adc to before 7acc1995bdcfdd82b2dd0dc735b1a4b076ae88a0Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before b80c4b5268c297b0503f65ef18038327e2119ad1Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before dae9cadf0925f1cbfb71306d60490890df3870a6Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before 15545ee71301e82d26d9a31b407ed0019eb62a60Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before 1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before 18813b90032bfaafb225906a4d2b51be4dfc02c3Affected 8e84c25821698bdef73c0329fb2022a4673b7adc to before 88a240d86d3d64521f9194abe185ac71cc74d0bdAffected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8e84c25821698bdef73c0329fb2022a4673b7adc to before 7acc1995bdcfdd82b2dd0dc735b1a4b076ae88a0Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before b80c4b5268c297b0503f65ef18038327e2119ad1Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before dae9cadf0925f1cbfb71306d60490890df3870a6Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before 15545ee71301e82d26d9a31b407ed0019eb62a60Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before 1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before 18813b90032bfaafb225906a4d2b51be4dfc02c3Affected
8e84c25821698bdef73c0329fb2022a4673b7adc to before 88a240d86d3d64521f9194abe185ac71cc74d0bdAffected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.