kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

A flaw was found in the Linux kernel's iwlwifi Intel Wireless WiFi driver. This vulnerability allows an attacker to cause an out-of-bounds memory access in the WiFi Block Acknowledgement BA session handlers. This occurs when the stamask value is zero, leading to an incorrect station ID calculatio...

kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

A flaw was found in the Linux kernel's iwlwifi Intel Wireless WiFi driver. This vulnerability allows an attacker to cause an out-of-bounds memory access in the WiFi Block Acknowledgement BA session handlers. This occurs when the stamask value is zero, leading to an incorrect station ID calculatio...

CVE-2026-80635

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability occurs because the driver does not adequately validate the length of certain firmware responses. An attacker could potentially craft a malicious firmware response, leading to an out-of-bounds read of stale heap data...

SUSE CVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

UBUNTU-CVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80635

CVE-2026-80635 is an out-of-bounds read vulnerability in the wcn36xx Wi-Fi driver of the Linux kernel. When processing a trigger BA (Block Acknowledgment) firmware response, the code checks the response length only against the base struct size (20 bytes). However, when candidate_cnt >= 1, a 22...

CVE-2026-80635 wifi: wcn36xx: fix OOB read from short trigger BA firmware response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80635 wifi: wcn36xx: fix OOB read from short trigger BA firmware response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

PT-2026-82935

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidate cnt = 1, a 22-byte candidate struct is read at buf + 20 without...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: Fixed the issue where tidtx was used after its free in the BA session stop routine. The function ieee80211stoptxbacb passes tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after releasing...

CVE-2026-74489

A flaw was found in the Linux kernel's mac80211 component, which manages Wi-Fi Wireless Fidelity networking. This use-after-free vulnerability occurs during the stopping of a Block Acknowledgement BA session. An attacker within the same network segment could exploit this by triggering the BA...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74489 wifi: mac80211: fix tid_tx use-after-free on BA session stop

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

SUSE CVE-2026-64255

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...

Linux Distros Unpatched Vulnerability : CVE-2026-64255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checki...

AZL-93351 CVE-2026-64255 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...

CVE-2026-64255

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...