CVE-2026-80635

Received Received - Intake

Out-of-Bounds Read in Linux Kernel WiFi Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80635

EUVD

EUVD-2026-67511

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's wifi driver wcn36xx. It involves an out-of-bounds read caused by insufficient validation of firmware response length. When a specific condition (candidate_cnt >= 1) is met, the code reads 22 bytes of data from a 20-byte response buffer, leading to corruption of the BA session state due to stale heap data being accessed.

Detection Guidance

This vulnerability involves an out-of-bounds read in the Linux kernel's wcn36xx WiFi driver. Detection requires checking kernel logs for related errors or kernel crashes after WiFi operations. Commands like dmesg | grep wcn36xx or journalctl -k | grep wcn36xx may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data or cause system instability by corrupting the BA session state in the Linux kernel. It may lead to crashes, unauthorized data access, or potential privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory corruption issue in WiFi firmware handling. Compliance impacts would depend on system-specific implementations and data exposure, which are not described here.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-80635. Reboot the system after updating. If immediate patching is not possible, disable the wcn36xx driver module temporarily by running rmmod wcn36xx.

Hi! I’m here to help you understand CVE-2026-80635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70