CVE-2026-80635
High
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Linux
PublishedAug 28, 2026
First seenAug 28, 2026
How to fix
Update
- Linux Linux04aba50212f9f274e1a726fb3873b5ce8da2d821, c07aa0534d50361183833e3803204044cf1d0476, d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35, af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee, d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2, b5e6f21923ca89d90256e7346301056f6502691e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 16be1ac55944412e8d132b1db26f994b368c5742 ≤ v < 04aba50212f9f274e1a726fb3873b5ce8da2d821, 16be1ac55944412e8d132b1db26f994b368c5742 ≤ v < c07aa0534d50361183833e3803204044cf1d0476, 16be1ac55944412e8d132b1db26f994b368c5742 ≤ v < d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35, 16be1ac55944412e8d132b1db26f994b368c5742 ≤ v < af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee, 16be1ac55944412e8d132b1db26f994b368c5742 ≤ v < d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2, 16be1ac55944412e8d132b1db26f994b368c5742 ≤ v < b5e6f21923ca89d90256e7346301056f6502691e, 4.7 | 04aba50212f9f274e1a726fb3873b5ce8da2d821, c07aa0534d50361183833e3803204044cf1d0476, d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35, af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee, d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2, b5e6f21923ca89d90256e7346301056f6502691e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.