High 8.8Published Aug 28, 2026

CVE-2026-80635wifi: wcn36xx: fix OOB read from short trigger BA firmware response

Updated under an hour ago (Oct 27, 2026, 1:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	16be1ac55944412e8d132b1db26f994b368c5742 builds before 04aba50212f9f274e1a726fb3873b5ce8da2d821; from 16be1ac55944412e8d132b1db26f994b368c5742 before c07aa0534d50361183833e3803204044cf1d0476; from 16be1ac55944412e8d132b1db26f994b368c5742 before d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35; from 16be1ac55944412e8d132b1db26f994b368c5742 before af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee; from 16be1ac55944412e8d132b1db26f994b368c5742 before d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2; from 16be1ac55944412e8d132b1db26f994b368c5742 before b5e6f21923ca89d90256e7346301056f6502691e	CNA record

References

References

https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821
https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476
https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35
https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee
https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2
https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.