Linux WiFi Driver Heap Buffer Over-Read Vulnerability

CVE-2026-80635 is an out-of-bounds (OOB) read vulnerability in the Linux kernel's WCN36xx WiFi driver that occurs during firmware response processing. The vulnerability stems from insufficient validation of response buffer lengths when parsing trigger block acknowledgment (BA) firmware responses. When the firmware indicates candidate_cnt >= 1, the driver attempts to read a 22-byte candidate structure at offset 20 without verifying the response buffer actually contains this data, leading to reads of uninitialized heap memory. This can corrupt BA session state, potentially disrupting WiFi connectivity, causing information disclosure of sensitive heap data, or enabling denial of service conditions. Any Linux system running the WCN36xx WiFi driver—commonly found in Qualcomm-based devices including many mobile phones, IoT devices, and embedded systems—is affected when connecting to malicious or compromised WiFi access points.

While CVE-2026-80635 lacks explicit MITRE ATT&CK mappings, the vulnerability's exploitation pattern aligns with memory safety detection mechanisms in Casky's extended reasoning skills. A Casky practitioner would observe detection findings centered on firmware response validation failures, buffer boundary checking gaps, and heap memory access anomalies. Claude's reasoning would correlate the OOB read behavior with potential Credential Access (T1056 - Observation) or Information Disclosure techniques if stale heap data containing session keys or credentials is exfiltrated, and Defense Evasion (T1027.11) if the corruption is weaponized to evade WiFi security mechanisms. The platform would highlight the attack chain: malicious firmware response → insufficient bounds checking → corrupted BA state → session compromise, enabling practitioners to detect similar validation bypass patterns across other kernel subsystems and firmware interfaces.