vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-74340

wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

HIGH
8.1
CVSS Score
Published: August 15, 2026 at 05:58 AM UTC
Updated: October 16, 2026 at 07:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.1
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
4.1143efa3c0f241e04862be8e6a68ff765d36cde1ba
Vendor states this is fixed in 0907c06dccae9e3c8d5a68eb9014beec73a36e79 (fixed)
Vendor states this is fixed in 22b0b8572a64362531dd0ed499b75e16282aeb2b (fixed)
Vendor states this is fixed in 23d210877968657bd07e1a517e0b516db20a1d80 (fixed)
Vendor states this is fixed in 3cf92b44c4fb88a5e8de8733a4494c0956606bca (fixed)
Vendor states this is fixed in 64228dfc4247aca178c01e5a37af7d8dcc7a6089 (fixed)
Vendor states this is fixed in df2187acfca6c6cca372c5d35f42394d9c270b09 (fixed)
Vendor states this is fixed in f03782f7f41f2afee5076a1ef08ced5649218771 (fixed)
Vendor states this is fixed in f987efff29a5fe45320ea5991c9d5cb98b676953 (fixed)
Vendor states this is fixed in 4.11 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/22b0b8572a64362531dd0ed499b75e16282aeb2b
Source: cverecord
https://git.kernel.org/stable/c/3cf92b44c4fb88a5e8de8733a4494c0956606bca
Source: cverecord
https://git.kernel.org/stable/c/0907c06dccae9e3c8d5a68eb9014beec73a36e79
Source: cverecord
https://git.kernel.org/stable/c/64228dfc4247aca178c01e5a37af7d8dcc7a6089
Source: cverecord
https://git.kernel.org/stable/c/23d210877968657bd07e1a517e0b516db20a1d80
Source: cverecord
https://git.kernel.org/stable/c/f03782f7f41f2afee5076a1ef08ced5649218771
Source: cverecord
https://git.kernel.org/stable/c/f987efff29a5fe45320ea5991c9d5cb98b676953
Source: cverecord
https://git.kernel.org/stable/c/df2187acfca6c6cca372c5d35f42394d9c270b09

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card