CVE-2026-80635
Published Aug 28, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.
Is your site exposed to CVE-2026-80635?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
0.0017
Probability of exploitation
0.07%
Percentile rank
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
References
Other References
https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821
https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee
https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e
https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476
https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35
https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2
Frequently Asked Questions
What is CVE-2026-80635? +
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix OOB read from short trigger BA firmware response
The firmware response length is only checked against sizeof(*rsp) (20
bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read
at buf + 20 without verifying the response contains it. This causes an
out-of-bounds read of stale heap data, corrupting the BA session state.
Add validation that the response includes the candidate data.
How do I check if I'm vulnerable to CVE-2026-80635? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.