CVE-2026-74340

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. The driver uses a firmware-controlled count to access a memory buffer without proper validation of the count's value. A malicious or malformed firmware response could provide an excessive count, leading to an out-of-bounds read from the heap-allocated message buffer. This vulnerability could allow an attacker to disclose sensitive information or cause a denial of service.

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access with specialized Qualcomm wireless hardware and compromised firmware, limiting the blast radius primarily to local denial of service. The wcn36xx driver is not enabled in default installations of Red Hat Enterprise Linux, preventing exposure under standard configurations. On systems where this driver is loaded, an untrusted firmware response could trigger an out-of-bounds heap read leading to kernel crashes or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.