CVE-2026-80635

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability occurs because the driver does not adequately validate the length of certain firmware responses. An attacker could potentially craft a malicious firmware response, leading to an out-of-bounds read of stale heap data. This can result in the corruption of the Block Acknowledgement (BA) session state, potentially causing a denial of service or information disclosure.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. When processing a trigger BA (Block Acknowledgement) firmware response, the driver validates the response length only against the 20-byte response header, so when the firmware reports one or more candidates (candidate_cnt >= 1), the driver reads a 22-byte candidate structure beyond the end of the response buffer. This out-of-bounds read of stale heap data corrupts the BA session state, which can result in a kernel panic and denial of service of the Wi-Fi subsystem; the CVE description also notes a potential for information disclosure. Triggering the flaw requires a crafted or malformed firmware response on a system using wcn36xx Wi-Fi hardware. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams are not affected by this flaw because the vulnerable code is not present in the shipped kernel packages. The upstream CVEORG severity for this flaw is important (CVSS 8.8, CVSS:3.1/AV:A/AC:L/PR:N), which differs from the Red Hat severity of moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L), because Red Hat assesses the primary consequence as a local, availability-only impact on the Wi-Fi subsystem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.