8.8

CVE-2026-80635

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

The firmware response length is only checked against sizeof(*rsp) (20
bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read
at buf + 20 without verifying the response contains it. This causes an
out-of-bounds read of stale heap data, corrupting the BA session state.

Add validation that the response includes the candidate data.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 16be1ac55944412e8d132b1db26f994b368c5742
Version < 04aba50212f9f274e1a726fb3873b5ce8da2d821
Status affected
Version 16be1ac55944412e8d132b1db26f994b368c5742
Version < c07aa0534d50361183833e3803204044cf1d0476
Status affected
Version 16be1ac55944412e8d132b1db26f994b368c5742
Version < d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35
Status affected
Version 16be1ac55944412e8d132b1db26f994b368c5742
Version < af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee
Status affected
Version 16be1ac55944412e8d132b1db26f994b368c5742
Version < d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2
Status affected
Version 16be1ac55944412e8d132b1db26f994b368c5742
Version < b5e6f21923ca89d90256e7346301056f6502691e
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.7
Status affected
Version 0
Version < 4.7
Status unaffected
Version <= 6.1.*
Version 6.1.178
Status unaffected
Version <= 6.6.*
Version 6.6.145
Status unaffected
Version <= 6.12.*
Version 6.12.97
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.174
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821
https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476
https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35
https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee
https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2
https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e