CVE-2026-74341

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content.

Add a bounds check on the response length.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux8e84c25821698bdef73c0329fb2022a4673b7adc < dae9cadf0925f1cbfb71306d60490890df3870a6affected
LinuxLinux8e84c25821698bdef73c0329fb2022a4673b7adc < cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92affected
LinuxLinux8e84c25821698bdef73c0329fb2022a4673b7adc < 15545ee71301e82d26d9a31b407ed0019eb62a60affected
LinuxLinux8e84c25821698bdef73c0329fb2022a4673b7adc < 1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18affected
LinuxLinux8e84c25821698bdef73c0329fb2022a4673b7adc < 18813b90032bfaafb225906a4d2b51be4dfc02c3affected
LinuxLinux8e84c25821698bdef73c0329fb2022a4673b7adc < 88a240d86d3d64521f9194abe185ac71cc74d0bdaffected
LinuxLinux3.13affected
LinuxLinux0 < 3.13unaffected
LinuxLinux6.1.178 <= 6.1.*unaffected
LinuxLinux6.6.145 <= 6.6.*unaffected
LinuxLinux6.12.97 <= 6.12.*unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References