CVE-2026-80635

What it actually does

Out-of-bounds read in wcn36xx WiFi driver when firmware response length passes only a 20-byte check but candidate_cnt >=1 requires reading an additional 22-byte struct at buf+20, accessing stale heap data and corrupting BA session state.

Why it matters to the business

Nearby attackers can induce kernel memory corruption on affected Linux devices, leading to wireless session failures, system instability, or potential escalation of privileges that disrupts operations and exposes the host.

How an attack unfolds

An attacker within adjacent wireless range induces or supplies a short trigger BA firmware response; the driver accepts the undersized buffer, skips additional length validation, and performs an out-of-bounds read that overwrites BA session structures with uncontrolled heap contents.

How to fix it

Apply the upstream kernel commit that adds an explicit length check ensuring the full candidate structure is present before any access beyond the initial 20-byte response header.

How to confirm the fix worked

Inspect wcn36xx source for the added response-length validation before the candidate read; replay short responses in a test harness and confirm absence of out-of-bounds accesses or state corruption.

Typical attack path

1. Gain adjacent network proximity to target WiFi interface
2. Trigger or spoof a BA session setup that elicits a short firmware response
3. Supply response whose length passes the sizeof(*rsp) check but lacks candidate data
4. Driver performs unchecked read of candidate struct, corrupting session state

How to detect it

Review kernel ring buffer and dmesg for wcn36xx-related faults or BA session warnings; correlate wireless frame captures showing anomalous trigger BA responses with subsequent driver errors.

What your security team should do

• Prioritize kernel updates containing the wcn36xx BA response validation fix
• Restrict or disable the wcn36xx driver on systems where wireless functionality is non-essential
• Monitor kernel logs for oops/panic entries referencing wcn36xx BA handling