CVE-2026-80635

CVE-2026-80635 is an out-of-bounds heap read in the Linux kernel's wcn36xx Wi-Fi driver, which supports Qualcomm WCN36xx wireless chipsets: the driver only validates that a trigger block-ack (BA) firmware response is at least 20 bytes, but when the response reports one or more candidates (candidate_cnt >= 1) it reads an additional 22-byte candidate structure at offset 20 without checking that the buffer actually contains it. If the firmware returns a shorter response, the driver reads past the end of the allocated buffer and pulls in stale heap memory. That stale data is copied into the block-ack session state, corrupting it; per the high (8.8) adjacent-network CVSS score this can produce high-impact confidentiality, integrity, and availability effects, most plausibly disrupted or misbehaving Wi-Fi sessions on the affected host. Only Linux systems running the wcn36xx driver are affected — primarily Qualcomm Snapdragon/WCN36xx-based development and embedded boards and community mainline-Linux device ports — not mainstream x86 laptops or Android devices using vendor Wi-Fi drivers. There is no known public proof-of-concept, no CISA KEV listing, and a low 0.3% EPSS probability, indicating no exploitation is currently observed or expected in the wild.

What to do: Apply the kernel patch that adds candidate-length validation for the trigger-BA firmware response as it propagates into your vendor's stable kernel updates (the source data provides no fixed release numbers, so track your distribution's kernel advisories). To gauge exposure, check whether affected systems load the driver (e.g., lsmod | grep wcn36xx). Until patched, restrict WCN36xx-based devices to trusted adjacent Wi-Fi networks, since exploitation requires on-link access to the affected host.