Linux Kernel CVE-2026-74341

Exploitation requires the target system to be running a Linux kernel in the vulnerable range (3.13 through the pre-patch versions) with the wcn36xx driver loaded and a Qualcomm WCN3620, WCN3660, or WCN3680 WiFi chipset physically present and active. The attacker must be within wireless adjacency of the target - either on the same WiFi network or within RF range to inject 802.11 frames. The CVSS vector PR:N confirms no authentication or privilege is required on the target system. The critical practical constraint is that the exploit must cause the WCN36xx chipset firmware to emit an oversized HAL response; this may require a rogue access point, frame injection capability, or firmware emulation. Exploitation over the internet or from arbitrary remote positions is not possible due to AV:A. Systems not using the WCN36xx hardware family (i.e., not loading the wcn36xx driver) are entirely unaffected regardless of kernel version.

The CVSS 3.1 score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H accurately reflects the attack surface: no authentication or user interaction required, low attack complexity once network-adjacent, and all three impact dimensions at high. The adjacent-network vector (AV:A) meaningfully constrains the attacker pool compared to a fully remote vulnerability - exploitation requires physical or logical proximity to the wireless medium. The EPSS score of 0.19% (9th percentile) is very low, indicating the broader security community has not observed widespread weaponization; this is consistent with the niche hardware footprint of the wcn36xx chipset. No CISA KEV listing and no public exploit code are identified at time of analysis. The overflow content is described as 'firmware-controlled,' which implies exploitation requires either a compromised or emulated Qualcomm WCN36xx firmware endpoint capable of sending crafted HAL responses - this represents a meaningful practical barrier to exploitation in most scenarios. For organizations deploying systems with WCN36xx hardware (certain IoT gateways, embedded platforms), the network-adjacent unauthenticated nature with heap overflow primitives makes this a genuine priority for patching despite low EPSS.

An attacker positioned on the same wireless network segment as a device using a Qualcomm WCN36xx WiFi chipset sends crafted 802.11 management or data frames designed to induce the chipset firmware to generate a HAL synchronous response exceeding 4096 bytes. The kernel driver copies this oversized response into the fixed-size hal_buf heap buffer without a length check, overwriting adjacent kernel heap memory with attacker-influenced content. Depending on heap layout, this can be leveraged to corrupt kernel data structures or redirect execution flow, potentially achieving kernel-level code execution. No public exploit code has been identified at time of analysis.