CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of firmware responses in the wcn36xx Wi-Fi driver, where insufficient validation allows for an out-of-bounds read of stale heap data. This could lead to corruption of the Block Acknowledgment (BA) session state, potentially impacting system stability and security. Linux system administrators and developers utilizing the affected Wi-Fi driver should prioritize applying the fix to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.