CVE-2026-74340 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer.
Add a check that count fits within the received message.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the wcn36xx wireless driver component of the linux kernel where an out-of-bounds read condition can be triggered through improper validation of firmware-controlled data. The issue manifests when processing PRINT_REG_INFO indication messages from the wireless firmware, specifically in how the driver handles the rsp->count field which serves as a loop boundary for accessing the flexible rsp->regs[] array. The vulnerability stems from a lack of bounds checking on the count value before it is used to index into heap-allocated memory structures.
The technical flaw represents a classic buffer overflow scenario where firmware-provided metadata directly controls program execution flow without adequate validation. The rsp->count field originates from untrusted firmware input and is used as a loop counter without verification against the actual message length constraints. This creates an environment where malicious or malformed firmware responses can cause the driver to read beyond allocated memory boundaries, potentially accessing adjacent heap memory regions that may contain sensitive data or corruption patterns.
From an operational impact perspective, this vulnerability could enable attackers to extract information from kernel memory through carefully crafted firmware responses, potentially leading to privilege escalation or system instability. The out-of-bounds reads may expose kernel stack contents, heap metadata, or other sensitive information depending on memory layout and the specific access patterns triggered by the malformed count value. Such vulnerabilities are particularly concerning in wireless driver contexts where firmware updates can occur dynamically and may not be fully trusted.
The fix implemented addresses this through explicit validation of the count field against the received message boundaries before any array indexing occurs. This approach aligns with security best practices for input validation and follows principles outlined in common weakness enumeration cwes 129 and 787 which address improper bounds checking and out-of-bounds reads respectively. The solution directly maps to mitigations recommended in the attack technique framework under defensive coding patterns for preventing memory corruption vulnerabilities.
The vulnerability demonstrates the critical importance of validating all firmware-controlled inputs in kernel space drivers, particularly when dealing with flexible array structures where metadata controls access patterns. This case highlights how seemingly benign data fields can become attack vectors when not properly validated against their operational constraints, emphasizing the need for comprehensive input sanitization in security-critical kernel components. The fix represents a straightforward but essential defensive measure that prevents potential information disclosure and memory corruption scenarios while maintaining the driver's intended functionality.
This type of vulnerability falls within the broader category of memory safety issues that affect embedded systems and device drivers, where firmware interactions require careful boundary validation to prevent exploitation. The resolution demonstrates proper secure coding practices by ensuring that all array access operations validate their indexing parameters against actual data dimensions before proceeding with memory operations.