Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:48.400Z",
  "pubdate": "2026-08-28T08:16:48.400Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) read within the Linux kernel wcn36xx Wi-Fi driver, specifically affecting firmware response processing for Block Ack (BA) sessions.\nThe flaw stems from insufficient input validation of the firmware response size before attempting to access embedded candidate structures.\nAn attacker capable of influencing or spoofing the firmware communication could cause the driver to read beyond the allocated buffer, potentially resulting in the disclosure of stale heap memory or corruption of the BA session state.\nThe impact includes potential memory corruption and kernel-level instability. The affected component is the wcn36xx wireless driver, which facilitates communication with Qualcomm WCN36xx series hardware. While typical exploitation requires control over the firmware or the communication interface, this represents a significant security oversight in the kernel-to-firmware interface.\nSuccessful exploitation requires the victim system to process a malformed BA response, leading to unintended memory access. There are no authentication requirements for the kernel logic itself, as it blindly trusts the response structure provided during the session negotiation process.",
  "technicalDetails": "The root cause of this vulnerability is an incomplete validation of the response length provided by the firmware during Block Ack (BA) session triggering. In the wcn36xx driver, the function responsible for processing firmware responses verifies that the total packet length is at least equal to the size of the response header structure, denoted by sizeof(*rsp), which is defined as 20 bytes.\nWhen the firmware response indicates that candidate_cnt is greater than or equal to one, the driver logic proceeds to access a supplementary 22-byte 'candidate' structure located at an offset of 20 bytes from the start of the buffer. However, the driver fails to confirm that the underlying heap allocation for the response buffer actually possesses enough space to accommodate these additional 22 bytes.\nIf the firmware response is truncated or maliciously crafted to be exactly 20 bytes while simultaneously declaring a candidate_cnt of one or greater, the driver performs an OOB read. This read operation attempts to access memory addresses situated immediately following the validly allocated buffer. Because these adjacent bytes are read as part of the internal data structures, the driver effectively incorporates stale heap data into the BA session state.\nThe exploitation flow is as follows: (1) The kernel sends a trigger command to the WCN36xx firmware. (2) The firmware returns a response packet that is specifically sized to pass the initial 20-byte check but lacks the subsequent 22-byte candidate struct. (3) The driver logic, trusting the candidate_cnt field, calculates the address for the candidate data and reads 22 bytes of memory from the kernel heap. (4) The kernel uses this leaked or corrupted heap memory to populate the BA session state variables. (5) This state corruption can lead to unpredictable kernel behavior, denial of service, or, in complex scenarios, provide an attacker with a primitive to influence subsequent kernel logic or gain unauthorized information regarding kernel memory contents.\nThis flaw exists because of a trust-boundary violation where the driver assumes that the internal fields of a firmware-supplied response are internally consistent with the total packet length received over the bus interface."
}