CVE-2026-80635

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

State: Published
Severity: 8.8 High
Published: Aug 28, 2026
Updated: Aug 29, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state.

Add validation that the response includes the candidate data.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	16be1ac55944412e8d132b1db26f994b368c5742 to before 04aba50212f9f274e1a726fb3873b5ce8da2d821Affected 16be1ac55944412e8d132b1db26f994b368c5742 to before c07aa0534d50361183833e3803204044cf1d0476Affected 16be1ac55944412e8d132b1db26f994b368c5742 to before d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35Affected 16be1ac55944412e8d132b1db26f994b368c5742 to before af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597eeAffected 16be1ac55944412e8d132b1db26f994b368c5742 to before d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2Affected 16be1ac55944412e8d132b1db26f994b368c5742 to before b5e6f21923ca89d90256e7346301056f6502691eAffected
LinuxLinux	4.7Affected before 4.7Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

16be1ac55944412e8d132b1db26f994b368c5742 to before 04aba50212f9f274e1a726fb3873b5ce8da2d821Affected
16be1ac55944412e8d132b1db26f994b368c5742 to before c07aa0534d50361183833e3803204044cf1d0476Affected
16be1ac55944412e8d132b1db26f994b368c5742 to before d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35Affected
16be1ac55944412e8d132b1db26f994b368c5742 to before af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597eeAffected
16be1ac55944412e8d132b1db26f994b368c5742 to before d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2Affected
16be1ac55944412e8d132b1db26f994b368c5742 to before b5e6f21923ca89d90256e7346301056f6502691eAffected

LinuxLinux

4.7Affected
before 4.7Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.