The driver processes a firmware trigger BA response without validating the presence of the optional candidate data. As a result, when the candidate count is one or more, it reads an additional 22‑byte structure from the buffer without checking that the data exists. This out‑of‑bounds read corrupts the background activity session state, which can lead to denial of service or improper handling of wireless sessions. The flaw is a classic CWE‑125 buffer overread that does not provide immediate code execution but can break session integrity.

Linux kernel builds that include the wcn36xx wireless driver before the fix are affected. Any host using a kernel version that has not applied the commit that implemented the response validation is at risk; no specific version ranges were listed, so all kernels prior to that commit may be impacted.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% and the absence from CISA’s KEV catalog suggest a low likelihood of current exploitation. The likely attack vector is that an adversary manipulates the firmware response sent to the driver, e.g., by using a rogue access point or compromised firmware. Because the vulnerability is an OOB read, it does not directly enable code execution, but it enables corruption of wireless session state, potentially causing denial of service.