The wcn36xx driver in the Linux kernel copies synchronous HAL responses from firmware into a fixed 4096‑byte buffer without validating the length. When a response exceeds the buffer size, a heap overflow occurs and the firmware can write arbitrary data into kernel memory. This is a classic buffer overflow that can compromise system integrity and potentially allow execution of arbitrary code within privileged kernel space.

Any Linux system that includes the wcn36xx wireless driver module and loads firmware for wcn36xx devices is affected. The public description does not specify particular kernel versions; therefore all kernels lacking the patch are vulnerable. The driver is typically used in consumer and embedded wireless hardware that relies on wcn36xx firmware.

The flaw is assigned a CVSS score of 8.8, indicating high severity. EPSS calculates the exploitation probability to be less than 1 %, which suggests that active exploitation in the wild is unlikely but not impossible. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector would involve an attacker supplying a malformed firmware image to the device, allowing the firmware to trigger the heap overflow. However, this scenario is inferred from the vulnerability details and not explicitly stated in the advisory content.