In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

The firmware-controlled rsp->count field is used as the loop bound for
indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of-
bounds reads from the heap-allocated message buffer.

Add a check that count fits within the received message.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0907c06dccae9e3c8d5a68eb9014beec73a36e79 cve-icon cve-icon
https://git.kernel.org/stable/c/22b0b8572a64362531dd0ed499b75e16282aeb2b cve-icon cve-icon
https://git.kernel.org/stable/c/23d210877968657bd07e1a517e0b516db20a1d80 cve-icon cve-icon
https://git.kernel.org/stable/c/3cf92b44c4fb88a5e8de8733a4494c0956606bca cve-icon cve-icon
https://git.kernel.org/stable/c/64228dfc4247aca178c01e5a37af7d8dcc7a6089 cve-icon cve-icon
https://git.kernel.org/stable/c/df2187acfca6c6cca372c5d35f42394d9c270b09 cve-icon cve-icon
https://git.kernel.org/stable/c/f03782f7f41f2afee5076a1ef08ced5649218771 cve-icon cve-icon
https://git.kernel.org/stable/c/f987efff29a5fe45320ea5991c9d5cb98b676953 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message.
Title wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:58:30.558Z

Reserved: 2026-08-15T05:44:03.885Z

Link: CVE-2026-74340

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:34.987

Modified: 2026-08-15T06:22:34.987

Link: CVE-2026-74340

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.