Executive brief
The wcn36xx WiFi driver in the Linux kernel has a buffer overflow vulnerability in its handling of firmware responses. When processing certain wireless network operations, the driver reads beyond the bounds of a received buffer, potentially exposing sensitive kernel memory and corrupting wireless connection state, which could cause denial of service or information disclosure.
Technical details
An out-of-bounds read vulnerability exists in the wcn36xx WiFi driver's trigger_ba_rsp function. The firmware response validation only checks that the buffer is at least 20 bytes (sizeof(*rsp)), but when candidate_cnt >= 1, the code attempts to read a 22-byte candidate struct at offset 20 without verifying the response actually contains this data. This causes an OOB read from stale heap memory, corrupting BA (Block Ack) session state. The vulnerability is local to the system running the affected kernel and requires the WiFi device to be present; exploitation occurs via malformed firmware responses. A fix has been released that adds length validation to ensure the response buffer contains the expected candidate data before attempting to read it.
Affected products
- Linux Linux kernel multiple versions prior to patch (wcn36xx driver in drivers/net/wireless/ath/wcn36xx/)
Timeline
- 2026-08-28: disclosed: Published to NVD
- 2026-04-21: patched: Upstream fix committed by Tristan Madani
- 2026-07-24: patched: Backported to stable kernel trees