GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80635 (GCVE-0-2026-80635)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
wifi: wcn36xx: fix OOB read from short trigger BA firmware response
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 16be1ac55944412e8d132b1db26f994b368c5742 , < 04aba50212f9f274e1a726fb3873b5ce8da2d821 (git)
Affected: 16be1ac55944412e8d132b1db26f994b368c5742 , < c07aa0534d50361183833e3803204044cf1d0476 (git)
Affected: 16be1ac55944412e8d132b1db26f994b368c5742 , < d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35 (git)
Affected: 16be1ac55944412e8d132b1db26f994b368c5742 , < af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee (git)
Affected: 16be1ac55944412e8d132b1db26f994b368c5742 , < d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2 (git)
Affected: 16be1ac55944412e8d132b1db26f994b368c5742 , < b5e6f21923ca89d90256e7346301056f6502691e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/wcn36xx/smd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04aba50212f9f274e1a726fb3873b5ce8da2d821",
              "status": "affected",
              "version": "16be1ac55944412e8d132b1db26f994b368c5742",
              "versionType": "git"
            },
            {
              "lessThan": "c07aa0534d50361183833e3803204044cf1d0476",
              "status": "affected",
              "version": "16be1ac55944412e8d132b1db26f994b368c5742",
              "versionType": "git"
            },
            {
              "lessThan": "d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35",
              "status": "affected",
              "version": "16be1ac55944412e8d132b1db26f994b368c5742",
              "versionType": "git"
            },
            {
              "lessThan": "af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee",
              "status": "affected",
              "version": "16be1ac55944412e8d132b1db26f994b368c5742",
              "versionType": "git"
            },
            {
              "lessThan": "d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2",
              "status": "affected",
              "version": "16be1ac55944412e8d132b1db26f994b368c5742",
              "versionType": "git"
            },
            {
              "lessThan": "b5e6f21923ca89d90256e7346301056f6502691e",
              "status": "affected",
              "version": "16be1ac55944412e8d132b1db26f994b368c5742",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/wcn36xx/smd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: fix OOB read from short trigger BA firmware response\n\nThe firmware response length is only checked against sizeof(*rsp) (20\nbytes), but when candidate_cnt \u003e= 1, a 22-byte candidate struct is read\nat buf + 20 without verifying the response contains it. This causes an\nout-of-bounds read of stale heap data, corrupting the BA session state.\n\nAdd validation that the response includes the candidate data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in parsing a WLAN firmware HAL response during TX block-ack setup; that path is reached only when an adjacent 802.11 peer drives AMPDU/BA negotiation over WiFi, not via remote IP or local syscalls.\nAC:L - An adjacent attacker can repeatedly send QoS data to a victim using wcn36xx to force ieee80211_start_tx_ba_session and wcn36xx_smd_trigger_ba, retrying until firmware returns a short TRIGGER_BA_RSP with candidate_cnt\u003e=1.\nPR:N - Exploitation requires only wireless adjacency as an associated AP or client peer; no Linux account, capabilities, or user-namespace privileges on the victim host are needed.\nUI:N - The victim needs no deliberate action beyond normal WiFi use; the attacker triggers BA setup by sending traffic that causes automatic AMPDU aggregation on the victim interface.\nS:U - Impact is confined to the kernel WiFi driver and its firmware session state on the same host; it does not cross VM, container, or IOMMU security boundaries.\nC:H - When candidate_cnt\u003e=1 but the response is only 20 bytes, the driver OOB-reads a 22-byte candidate from stale hal_buf data beyond the message, disclosing adjacent kernel buffer contents that may include prior HAL keying material.\nI:H - Stale OOB data is copied into ba_info and used as the block-ack starting sequence number for wcn36xx_smd_add_ba_session, corrupting BA session state and subsequent driver/firmware behavior.\nA:H - Corrupted block-ack parameters and malformed firmware/driver state can destabilize the WLAN subsystem, causing connection loss, firmware/driver errors, or kernel crashes under repeated attack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:35.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821"
        },
        {
          "url": "https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35"
        },
        {
          "url": "https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e"
        }
      ],
      "title": "wifi: wcn36xx: fix OOB read from short trigger BA firmware response",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80635",
    "datePublished": "2026-08-28T06:48:49.637Z",
    "dateReserved": "2026-08-26T14:34:25.777Z",
    "dateUpdated": "2026-08-29T06:21:35.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80635",
      "date": "2026-09-17",
      "epss": "0.0026",
      "percentile": "0.17889"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80635\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:48.400\",\"lastModified\":\"2026-08-29T07:16:47.537\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: wcn36xx: fix OOB read from short trigger BA firmware response\\n\\nThe firmware response length is only checked against sizeof(*rsp) (20\\nbytes), but when candidate_cnt \u003e= 1, a 22-byte candidate struct is read\\nat buf + 20 without verifying the response contains it. This causes an\\nout-of-bounds read of stale heap data, corrupting the BA session state.\\n\\nAdd validation that the response includes the candidate data.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/wcn36xx/smd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"16be1ac55944412e8d132b1db26f994b368c5742\",\"lessThan\":\"04aba50212f9f274e1a726fb3873b5ce8da2d821\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16be1ac55944412e8d132b1db26f994b368c5742\",\"lessThan\":\"c07aa0534d50361183833e3803204044cf1d0476\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16be1ac55944412e8d132b1db26f994b368c5742\",\"lessThan\":\"d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16be1ac55944412e8d132b1db26f994b368c5742\",\"lessThan\":\"af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16be1ac55944412e8d132b1db26f994b368c5742\",\"lessThan\":\"d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16be1ac55944412e8d132b1db26f994b368c5742\",\"lessThan\":\"b5e6f21923ca89d90256e7346301056f6502691e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/wcn36xx/smd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T12:15:43+00:00",
      "cve": "CVE-2026-80635",
      "id": "CVE-2026-80635",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: wcn36xx: fix OOB read from short trigger BA firmware response",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80635.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:27:54Z",
      "cve": "CVE-2026-80635",
      "id": "CVE-2026-80635",
      "initial_release_date": "2026-08-28T16:35:37Z",
      "product_status:known_affected": "263",
      "product_status:known_not_affected": "90",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80635",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80635.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.