High 8.1Published Aug 15, 2026

CVE-2026-74340wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

Updated under an hour ago (Oct 28, 2026, 10:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	43efa3c0f241e04862be8e6a68ff765d36cde1ba builds before 22b0b8572a64362531dd0ed499b75e16282aeb2b; 43efa3c0f241e04862be8e6a68ff765d36cde1ba builds before 3cf92b44c4fb88a5e8de8733a4494c0956606bca; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before 0907c06dccae9e3c8d5a68eb9014beec73a36e79; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before 64228dfc4247aca178c01e5a37af7d8dcc7a6089; 43efa3c0f241e04862be8e6a68ff765d36cde1ba builds before 23d210877968657bd07e1a517e0b516db20a1d80; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before f03782f7f41f2afee5076a1ef08ced5649218771; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before f987efff29a5fe45320ea5991c9d5cb98b676953; from 43efa3c0f241e04862be8e6a68ff765d36cde1ba before df2187acfca6c6cca372c5d35f42394d9c270b09	CNA record

References

References

https://git.kernel.org/stable/c/22b0b8572a64362531dd0ed499b75e16282aeb2b
https://git.kernel.org/stable/c/3cf92b44c4fb88a5e8de8733a4494c0956606bca
https://git.kernel.org/stable/c/0907c06dccae9e3c8d5a68eb9014beec73a36e79
https://git.kernel.org/stable/c/64228dfc4247aca178c01e5a37af7d8dcc7a6089
https://git.kernel.org/stable/c/23d210877968657bd07e1a517e0b516db20a1d80
https://git.kernel.org/stable/c/f03782f7f41f2afee5076a1ef08ced5649218771
https://git.kernel.org/stable/c/f987efff29a5fe45320ea5991c9d5cb98b676953
https://git.kernel.org/stable/c/df2187acfca6c6cca372c5d35f42394d9c270b09

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.