CVE-2026-80635

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read occurs in the wcn36xx wifi driver when processing a short trigger BA firmware response. The system only validates the response length against the size of the response structure (20 bytes). However, if the candidate cnt variable is greater than or equal to 1, the driver attempts to read a 22-byte candidate structure starting at offset 20 without verifying if the response actually contains this data. This leads to the reading of stale heap data, which corrupts the BA session state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.