EUVD-2026-59487
GHSA-9fwg-3fvg-fm8h
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Adjacent WiFi link-layer attack requiring no privileges; OOB heap read leaks kernel memory (C:H) and risks kernel panic (A:H); no integrity impact applies.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer.
Add a check that count fits within the received message.
AnalysisAI
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must have a Qualcomm WCN36xx series WiFi chipset (WCN3620, WCN3660, or WCN3680) installed, the wcn36xx kernel module loaded, and the WiFi interface active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N produces a score of 8.1, reflecting a plausible no-authentication adjacent-network attack path that requires only radio proximity and no user interaction - a genuine concern for devices deployed in untrusted RF environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positions a rogue WiFi access point within radio range of a target device equipped with a Qualcomm WCN36xx chipset running an unpatched Linux kernel. By manipulating the WiFi firmware's PRINT_REG_INFO indication - either through crafted over-the-air frames or by leveraging the rogue AP to influence chipset firmware state - the attacker causes the firmware to report an inflated rsp->count value. … |
| Remediation | Upgrade to a patched Linux kernel stable release appropriate to your branch: 5.10.261 or later, 5.15.212 or later, 6.1.178 or later, 6.6.145 or later, 6.12.97 or later, 6.18.40 or later, or 7.1.5 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernel versions with vulnerable wcn36xx driver code (introduced circa 4.11 era) by scanning for WCN36xx chipset presence and correlating against affected kernel versions across the seven stable branches with available patches. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today