HIGH Introduced in 4.7
wcn36xx TriggerBA OOB
CVE-2026-80635
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.
02KernelScan AI Analysis
Risk summary
An attacker on the same WiFi network as a device using a Qualcomm WCN36xx WiFi chipset can trigger Block Ack negotiation that causes the driver to read beyond a firmware response buffer. This exposes stale heap data and corrupts WiFi session state. The vulnerability requires specific WiFi hardware and an adjacent network position.
Vulnerability analysis
The WiFi driver for Qualcomm WCN36xx chipsets does not verify that a firmware response for Block Ack session setup is large enough to contain the candidate information structure before reading past the initial response header. When the firmware sends a response shorter than expected but indicates at least one candidate exists, the driver reads stale heap memory beyond the allocated buffer, corrupting Block Ack session state with arbitrary data. The fix adds a length check ensuring the response buffer is large enough to contain the candidate structure before it is accessed. This vulnerability is reachable by an attacker on the same WiFi network who can trigger Block Ack negotiation, or by a local process that can initiate WiFi operations through the driver, and requires specific Qualcomm WCN36xx WiFi hardware to be present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 4.7 | 6.1.178 | 04aba50212f9 |
| 6.18 | 4.7 | 6.18.40 | af8f0ea1f0a3 |
| mainline | 4.7 | 7.2 | b5e6f21923ca |
| 6.6 | 4.7 | 6.6.145 | c07aa0534d50 |
| 6.12 | 4.7 | 6.12.97 | d0b57bcd0dac |
| 7.1 | 4.7 | 7.1.5 | d0cafe6ed8d1 |
| cip/6.1 | 4.7 | 6.1.182-cip59 | 04aba50212f9 |
| cip/6.1-rt | 4.7 | 6.1.182-cip59-rt31 | 04aba50212f9 |
| cip/6.12 | 4.7 | 6.12.101-cip29 | d0b57bcd0dac |