CVE-2026-80635

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state.

Add validation that the response includes the candidate data.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux16be1ac55944412e8d132b1db26f994b368c5742 < 04aba50212f9f274e1a726fb3873b5ce8da2d821affected
LinuxLinux16be1ac55944412e8d132b1db26f994b368c5742 < c07aa0534d50361183833e3803204044cf1d0476affected
LinuxLinux16be1ac55944412e8d132b1db26f994b368c5742 < d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35affected
LinuxLinux16be1ac55944412e8d132b1db26f994b368c5742 < af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597eeaffected
LinuxLinux16be1ac55944412e8d132b1db26f994b368c5742 < d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2affected
LinuxLinux16be1ac55944412e8d132b1db26f994b368c5742 < b5e6f21923ca89d90256e7346301056f6502691eaffected
LinuxLinux4.7affected
LinuxLinux0 < 4.7unaffected
LinuxLinux6.1.178 <= 6.1.*unaffected
LinuxLinux6.6.145 <= 6.6.*unaffected
LinuxLinux6.12.97 <= 6.12.*unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References