CVE-2026-80635 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix OOB read from short trigger BA firmware response
The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state.
Add validation that the response includes the candidate data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel driver for Qualcomm Atheros WCN36xx Wi-Fi adapters contained a critical memory safety flaw within its handling of Block Acknowledgment (BA) firmware responses. This vulnerability, identified as an out-of-bounds read, stems from insufficient validation of the length field in data structures received from the device's firmware. Specifically, when processing trigger BA responses, the driver checks if the response size is at least twenty bytes to satisfy the minimum requirements for a standard header structure. However, this check fails to account for additional payload data that may be present under certain conditions. When the candidate count field indicates one or more candidates are included in the response, the code proceeds to read an additional twenty-two-byte candidate struct located immediately after the initial twenty bytes of the buffer. Because no further verification is performed to ensure the total response length accommodates this extra data, the driver accesses memory beyond the allocated bounds of the firmware response buffer.
This out-of-bounds access results in the reading of stale heap data that resides adjacent to the original allocation. The integrity of the BA session state is subsequently compromised as the kernel interprets these uninitialized or arbitrary memory contents as valid candidate information. Such corruption can lead to unpredictable driver behavior, including potential denial of service conditions where the Wi-Fi connection becomes unstable or drops entirely due to invalid internal state transitions. In more severe scenarios involving specific heap layouts and subsequent use of this corrupted data, there is a theoretical risk that an attacker with local access could influence kernel execution flow or leak sensitive information from adjacent memory regions, although the primary impact observed in typical deployments remains stability degradation rather than direct privilege escalation.
From a classification perspective, this vulnerability aligns with CWE-125, which describes out-of-bounds read operations where software reads data past the end of a buffer. It also relates to CWE-20 regarding improper input validation, as the application failed to correctly validate that the received data met all expected structural constraints before processing it. In terms of attack vectors and techniques, this flaw could potentially be leveraged within the context of ATT&CK technique T1564, specifically hiding execution artifacts or manipulating system state through memory corruption, although its primary manifestation is a reliability issue rather than an active exploitation path for remote code execution. The vulnerability highlights the importance of rigorous boundary checks in kernel-space drivers that interface directly with hardware firmware responses.
To mitigate this risk, developers must implement strict length validation prior to accessing any variable-length payload within firmware response buffers. In this specific case, the fix involves verifying that the total size of the received message is sufficient to contain both the base header and all declared candidate structures before attempting to read them into kernel memory. This ensures that no out-of-bounds reads occur regardless of the values provided by the hardware or firmware. System administrators should apply available kernel updates that include this patch for affected WCN36xx drivers. Additionally, ongoing security reviews of driver code should prioritize static analysis tools capable of detecting buffer boundary violations and dynamic testing methods that fuzz input structures to uncover similar logic errors in other network subsystems within the Linux kernel.