Executive brief
The Linux kernel's WCN36xx wireless driver, which manages Qualcomm Wi-Fi chipsets, contains a heap buffer overflow vulnerability in its firmware response handler. An attacker with control of the Wi-Fi firmware could send a specially crafted response that overwrites kernel memory, potentially leading to privilege escalation, system crash, or arbitrary code execution on affected systems.
Technical details
The vulnerability is a heap buffer overflow in the wcn36xx wireless driver's synchronous HAL response handler (drivers/net/wireless/ath/wcn36xx/smd.c). The dispatcher copies firmware responses into a fixed 4096-byte hal_buf buffer (WCN36XX_HAL_BUF_SIZE) without validating the response length, allowing oversized responses to overflow the heap with firmware-controlled content. This is triggered during normal firmware communication when a response exceeds the buffer size. The fix adds a bounds check that validates the response length before copying, dropping responses that exceed the limit. Exploitation requires control of the Wi-Fi firmware or ability to craft malicious responses at the physical or network transport layer.
Affected products
- Linux Linux Kernel multiple versions (driver present since 8e84c2582169)
Timeline
- 2026-08-15: disclosed
- 2026-04-21: patched
- other: Fix committed to stable Linux kernel branches from 4.4.y through 7.2.y