CVE-2026-80635

8.8 Élevée

Publiée le 28/08/2026 à 10:16 · Modifiée le 29/08/2026 à 09:16 · Reçue · Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.

Traduire en français

Produits concernés

Linux

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	416baaa9-dc9f-4396-8d5f-8c081fb06d67	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Références

https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821
https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee
https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e
https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476
https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35
https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories