CVE-2026-74341: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
Published Aug 15, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding WCN36XXHALBUFSIZE causes a heap buffer overflow with firmware-controlled content.
Add a bounds check on the response length.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the firmware response dispatcher code to validate the synchronous HAL response length before copying into the 4096-byte hal_buf (WCN36XX_HAL_BUF_SIZE), preventing heap buffer overflow from firmware-controlled oversized responses.
Linux kernel (wifi: wcn36xx) firmware response dispatcher Add bounds check for synchronous HAL response length before copying into hal_buf = Validate response length against WCN36XX_HAL_BUF_SIZE / 4096 bytes and reject/truncate oversized responses
Event History
Aug 15, 2026
CVE Published
via MITRE·05:58 AM
Data Sourced
via MITRE·05:58 AM
Description