CVE-2026-80635 PUBLISHED

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

Assigner: Linux
Reserved: 26.08.2026 Published: 28.08.2026 Updated: 28.08.2026

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state.

Add validation that the response includes the candidate data.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 16be1ac55944412e8d132b1db26f994b368c5742 to 04aba50212f9f274e1a726fb3873b5ce8da2d821 (excl.)
  • affected from 16be1ac55944412e8d132b1db26f994b368c5742 to c07aa0534d50361183833e3803204044cf1d0476 (excl.)
  • affected from 16be1ac55944412e8d132b1db26f994b368c5742 to d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35 (excl.)
  • affected from 16be1ac55944412e8d132b1db26f994b368c5742 to af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee (excl.)
  • affected from 16be1ac55944412e8d132b1db26f994b368c5742 to d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2 (excl.)
  • affected from 16be1ac55944412e8d132b1db26f994b368c5742 to b5e6f21923ca89d90256e7346301056f6502691e (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 4.7 is affected
  • unaffected from 0 to 4.7 (excl.)
  • unaffected from 6.1.178 to 6.1.* (incl.)
  • unaffected from 6.6.145 to 6.6.* (incl.)
  • unaffected from 6.12.97 to 6.12.* (incl.)
  • unaffected from 6.18.40 to 6.18.* (incl.)
  • unaffected from 7.1.5 to 7.1.* (incl.)
  • unaffected from 7.2 to * (incl.)

References