CVE-2026-80635: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80635 Overview

CVE-2026-80635 is an out-of-bounds read vulnerability in the Linux kernel wcn36xx Wi-Fi driver. The flaw resides in the trigger Block Acknowledgment (BA) firmware response handler. The driver validates the response length against sizeof(*rsp) (20 bytes) but reads a 22-byte candidate structure at offset buf + 20 when candidate_cnt >= 1. This missing bounds check causes the driver to read stale heap data beyond the allocated response buffer, corrupting the BA session state.

The vulnerability affects systems using Qualcomm WCN36xx wireless chipsets on Linux. Exploitation requires adjacent network access to deliver a malformed firmware response through the wireless interface.

Critical Impact
An attacker on an adjacent network can trigger out-of-bounds heap reads in the kernel, corrupting Block Ack session state and potentially exposing kernel memory or destabilizing the wireless subsystem.

Affected Products

Linux kernel builds containing the wcn36xx Wi-Fi driver
Devices using Qualcomm WCN36xx wireless chipsets (common in ARM-based SoCs and embedded platforms)
Distributions shipping vulnerable kernel versions prior to the patch commits referenced by upstream stable trees

Discovery Timeline

2026-08-28 - CVE-2026-80635 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80635

Vulnerability Analysis

The defect lives in the wcn36xx driver's handler for trigger BA firmware responses. The response buffer is validated only against the base response structure size of 20 bytes. When the firmware indicates candidate_cnt >= 1, the driver dereferences an additional 22-byte candidate structure at offset buf + 20 without confirming the buffer actually contains those bytes.

The result is a read past the end of the allocated response, pulling stale heap data into the BA session logic. That stale data is then used to configure block acknowledgment state, corrupting driver-managed session structures. The consequences include kernel information disclosure, unpredictable wireless behavior, and potential follow-on memory safety issues when corrupted state is later dereferenced.

Root Cause

The root cause is missing input validation on a variable-length firmware message. The driver assumes the firmware transport delivered a complete message whenever the fixed header size is met. It does not compute the required total length as sizeof(*rsp) + candidate_cnt * sizeof(candidate) before reading the trailing candidate structure. This is a classic out-of-bounds read stemming from trusting a length-carrying field without cross-checking the actual buffer size.

Attack Vector

An attacker within wireless range can influence the trigger BA exchange handled by the driver. By causing the firmware to emit a short response that still advertises candidate_cnt >= 1, the attacker triggers the OOB read. Because the driver runs in kernel context, corrupted BA session state and leaked heap contents can be leveraged for reconnaissance of kernel memory layout or to destabilize the wireless stack. The attack does not require authentication or user interaction.

No verified proof-of-concept code has been published. See the upstream fix commits, including Linux Kernel Commit 04aba50 and Linux Kernel Commit d0cafe6, for the exact validation logic added by maintainers.

Detection Methods for CVE-2026-80635

Indicators of Compromise

Unexpected kernel log entries from the wcn36xx driver referencing BA session errors, malformed responses, or session teardown
Wireless interface instability, repeated reassociation, or driver resets on hosts using Qualcomm WCN36xx chipsets
KASAN or slab debugging reports flagging out-of-bounds reads in wcn36xx trigger BA response handling

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to surface the OOB read directly in wcn36xx code paths
Monitor dmesg and journal logs for wcn36xx warnings, MAC layer errors, and abnormal BA session churn
Inventory endpoints and embedded devices running kernels that include the wcn36xx driver and compare against patched stable versions

Monitoring Recommendations

Forward kernel and Wi-Fi driver logs to a centralized log platform for anomaly review and long-term retention
Baseline normal wireless driver behavior so unusual BA session activity and repeated driver resets stand out
Track Linux kernel patch levels across managed Linux endpoints and IoT devices to confirm remediation coverage

How to Mitigate CVE-2026-80635

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits to all systems running the wcn36xx driver
Prioritize embedded, mobile, and IoT devices where kernel updates are typically delayed and WCN36xx chipsets are common
If patching is not immediately possible, restrict exposure of affected devices to untrusted wireless environments

Patch Information

The fix adds validation that the firmware response length includes the candidate data before it is read. Backports are available across stable trees in the following commits: Linux Kernel Commit 04aba50, Linux Kernel Commit af8f0ea, Linux Kernel Commit b5e6f21, Linux Kernel Commit c07aa05, Linux Kernel Commit d0b57bc, and Linux Kernel Commit d0cafe6. Update to a distribution kernel that incorporates one of these commits.

Workarounds

Unload the wcn36xx module on systems that do not require the affected wireless chipset
Disable the Wi-Fi interface on devices operating in trusted, wired-only deployments until a patched kernel is installed
Segment vulnerable devices onto isolated wireless networks with limited peer connectivity to reduce the adjacent-network attack surface

bash

# Temporarily disable the vulnerable driver until a patched kernel is installed
sudo modprobe -r wcn36xx
echo "blacklist wcn36xx" | sudo tee /etc/modprobe.d/blacklist-wcn36xx.conf

# Verify the running kernel version after patching
uname -r