CVE-2026-74341

CVE-2026-74341 reveals a trust-boundary failure in the wcn36xx wireless driver where the kernel treats firmware responses as implicitly trusted. The vulnerability lives in the HAL response dispatcher: when firmware returns a response exceeding the 4096-byte hal_buf allocation, the driver writes beyond heap boundaries without any bounds validation. This is not a simple missing check—it represents a fundamental design assumption that firmware will never lie about response sizes, an assumption that survives from the original firmware-driver co-development team into upstreamed code now maintained by community members without full firmware documentation. The exploitation path matters more than the CVSS suggests. You do not need exotic firmware compromise to trigger this. Any vulnerability in Wi-Fi stack parsing—malformed association frames, Evil Twin attacks, RF injection that corrupts firmware-reported state—can serve as a primitive to influence what the firmware tells the driver. The firmware is already being manipulated by adversaries through normal radio interactions; this CVE makes that manipulation a kernel heap corruption vector. The 4096-byte buffer size itself is telling: it reflects throughput tuning, not a security boundary, which explains why this pattern persists across wireless drivers optimized for latency over defensive parsing. For defenders, prioritize these actions: audit all HAL response paths in wcn36xx and similar Qualcomm wireless drivers for missing bounds checks—this is likely a systemic pattern, not an isolated flaw. Treat firmware responses as untrusted input regardless of how firmware behaves, because the driver cannot verify firmware integrity. Review your kernel configuration for wcn36xx module loading in high-risk environments; the blast radius is kernel-context execution. The patch behavior matters: if it simply drops oversized responses, any adjacent firmware bug becomes a denial-of-service vector. If it truncates, silent data corruption may propagate to higher-layer state machines. Monitor for driver crashes or wireless stack instability following firmware updates, as either could indicate the fix is rejecting previously accepted (but now recognized as oversized) responses. The systemic fix is not this CVE alone—it is a broader audit of how wireless drivers handle coprocessor responses across the ecosystem.

Reviewed through automated stages and approved by a human before publication.