CVE-2026-74340
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In the Linux kernel wifi driver wcn36xx, there is an out-of-bounds read caused by lack of validation of the firmware-controlled count field in the PRINT_REG_INFO message. An overly large count can lead to reading beyond the buffer.
Risk Assessment
This can lead to information leak from kernel memory or system crash.
Recommendation
Apply the kernel patch that adds a check that count fits within the received message.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message.