EUVD-2026-59488
GHSA-8q74-796q-49pm
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network attack requiring no privileges or interaction; heap overflow with firmware-controlled content yields full kernel impact across all three dimensions.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content.
Add a bounds check on the response length.
AnalysisAI
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to be running a Linux kernel in the vulnerable range (3.13 through the pre-patch versions) with the wcn36xx driver loaded and a Qualcomm WCN3620, WCN3660, or WCN3680 WiFi chipset physically present and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H accurately reflects the attack surface: no authentication or user interaction required, low attack complexity once network-adjacent, and all three impact dimensions at high. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the same wireless network segment as a device using a Qualcomm WCN36xx WiFi chipset sends crafted 802.11 management or data frames designed to induce the chipset firmware to generate a HAL synchronous response exceeding 4096 bytes. The kernel driver copies this oversized response into the fixed-size hal_buf heap buffer without a length check, overwriting adjacent kernel heap memory with attacker-influenced content. … |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.1.178 or later in the 6.1 series, 6.6.145 or later in the 6.6 series, 6.12.97 or later in the 6.12 series, 6.18.40 or later in the 6.18 series, or 7.1.5 or later in the 7.x series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Linux systems with Qualcomm WCN36xx WiFi drivers in production, documenting kernel versions and deployment locations using asset management tools and 'uname -r' queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today