---
id: CVE-2026-74341
title: 'wifi: wcn36xx: fix heap overflow from oversized firmware HAL response'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

  The firmware response dispatcher copies all synchronous HAL responses
  into the 4096-byte hal_buf …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    7acc1995bdcfdd82b2dd0dc735b1a4b076ae88a0
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    b80c4b5268c297b0503f65ef18038327e2119ad1
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    dae9cadf0925f1cbfb71306d60490890df3870a6
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    15545ee71301e82d26d9a31b407ed0019eb62a60
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    18813b90032bfaafb225906a4d2b51be4dfc02c3
  - >-
    Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc <
    88a240d86d3d64521f9194abe185ac71cc74d0bd
  - Linux 3.13
published: '2026-08-15'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:29:46.830Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74341'
references:
  - url: 'https://git.kernel.org/stable/c/7acc1995bdcfdd82b2dd0dc735b1a4b076ae88a0'
  - url: 'https://git.kernel.org/stable/c/b80c4b5268c297b0503f65ef18038327e2119ad1'
  - url: 'https://git.kernel.org/stable/c/dae9cadf0925f1cbfb71306d60490890df3870a6'
  - url: 'https://git.kernel.org/stable/c/cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92'
  - url: 'https://git.kernel.org/stable/c/15545ee71301e82d26d9a31b407ed0019eb62a60'
  - url: 'https://git.kernel.org/stable/c/1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18'
  - url: 'https://git.kernel.org/stable/c/18813b90032bfaafb225906a4d2b51be4dfc02c3'
  - url: 'https://git.kernel.org/stable/c/88a240d86d3d64521f9194abe185ac71cc74d0bd'
tags:
  - cve.org
epss: 0.00532
epssPercentile: 0.45251
ingestedAt: '2026-11-05T15:02:32.538Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

The firmware response dispatcher copies all synchronous HAL responses
into the 4096-byte hal_buf without validating the response length. A
response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow
with firmware-controlled content.

Add a bounds check on the response length.

## Affected

- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < 7acc1995bdcfdd82b2dd0dc735b1a4b076ae88a0`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < b80c4b5268c297b0503f65ef18038327e2119ad1`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < dae9cadf0925f1cbfb71306d60490890df3870a6`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < 15545ee71301e82d26d9a31b407ed0019eb62a60`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < 1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < 18813b90032bfaafb225906a4d2b51be4dfc02c3`
- `Linux >= 8e84c25821698bdef73c0329fb2022a4673b7adc < 88a240d86d3d64521f9194abe185ac71cc74d0bd`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.